Kernel Memory Corruption via Largepage Object Syscalls

CVE-2026-49428 is a kernel memory safety vulnerability affecting system calls like open(2) with O_TRUNC and fspacectl(2) on largepage objects. These operations should be prohibited on largepage memory, but insufficient validation allows unprivileged local users to trigger incorrect memory freeing. By exploiting this use-after-free condition, attackers can read freed kernel memory and leverage that information disclosure to escalate privileges to root. This affects any system running vulnerable FreeBSD versions where local user access is possible, making it a critical privilege escalation vector that bypasses traditional access controls.

While this CVE lacks mapped MITRE ATT&CK techniques, Casky's 754 security skills powered by Claude AI would detect the attack patterns through memory access anomalies and privilege boundary violations. A practitioner using Casky would observe suspicious syscall sequences—specifically open() or fspacectl() operations targeting largepage allocations followed by kernel memory reads from freed regions. Claude's extended reasoning would correlate these low-level kernel events with CWE-915 (Improper Initialization) patterns, flagging the use-after-free chain as privilege escalation preparation. Security teams would see findings highlighting abnormal kernel memory access patterns from unprivileged processes, enabling detection before privilege escalation completes.