CVE-2026-49427: posixshm: largepage shared memory objects not explicitly wired
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them.
An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using largepage POSIX shared memory objects are exposed if an unprivileged local user can run code on the system. The issue is local; the provided information does not describe a remote attack path.
What does an attacker need to exploit it?
An attacker needs local unprivileged access and must be able to abuse sendfile(2) on a largepage shared memory object with the SF_NOCACHE flag. Successful exploitation can provide access to freed kernel memory and enable privilege escalation.
What is the impact if exploitation succeeds?
sendfile(2) can free pages that are still referenced by existing mappings, creating access to freed kernel memory. An unprivileged local attacker may leverage this condition to escalate privileges.