CVE-2026-49428: posixshm: system calls can incorrectly free memory of largepage objects
Certain system calls, such open(2) with the OTRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this.
An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected posixshm implementation are exposed to unprivileged local users. The described impact requires local access; no remote attack path is stated.
What does an attacker need to exploit it?
An attacker needs to be able to act as an unprivileged local user and invoke operations such as open(2) with O_TRUNC or fspacectl(2) against largepage objects. Successful exploitation can provide access to freed kernel memory and enable privilege escalation.
Are normal operations on largepage objects supposed to permit this behavior?
No. The affected operations are not permitted on largepage objects, but the implementation failed to enforce that restriction.