Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-49412

Use-after-free bug in the IPV6_MSFILTER socket option handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory. An unprivileged local user can exploit this use-after-free to escalate privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.0-RELEASE to < p10affected
  • 14.4-RELEASE to < p6affected
  • 14.3-RELEASE to < p15affected

References