Detections
Analytics
CVE-2026-49428
high
Description
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. [CVE-2026-49427] Separately, certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. [CVE-2026-49428] An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.