Largepage Shared Memory Pages Prematurely Freed in sendfile

CVE-2026-49427 is a use-after-free vulnerability in the FreeBSD kernel's handling of large pages during sendfile operations with the SF_NOCACHE flag. When sendfile transmits largepage shared memory objects, it incorrectly frees the underlying physical pages immediately after transmission, despite active kernel and user-space mappings still referencing them. This creates a window where an unprivileged local attacker can access freed kernel memory—reading sensitive data or corrupting kernel structures to achieve privilege escalation. The vulnerability affects any FreeBSD system where users have access to sendfile functionality and can create or manipulate largepage shared memory segments, making it a significant local privilege escalation risk.

While this CVE has no direct MITRE ATT&CK technique mapping, Casky's Claude-powered analysis would detect the underlying attack patterns associated with privilege escalation (T1134 and related techniques). A practitioner reviewing findings would observe indicators including: abnormal use-after-free memory access patterns in sendfile syscall traces, unexpected kernel memory reads from unprivileged processes, largepage shared memory object manipulation followed by privilege transitions, and kernel panic or memory corruption artifacts in system logs. Casky's extended reasoning would correlate these signals—particularly the combination of shared memory operations with SF_NOCACHE flag usage and subsequent elevated process execution—to surface the attack chain before exploitation occurs, enabling defenders to patch systems and restrict local sendfile access patterns proactively.