CVE-2026-49412— Use-after-free bug in the IPV6_MSFILTER socket option handler
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49412
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Use-after-free bug in the IPV6_MSFILTER socket option handler
Source: NVD (National Vulnerability Database)
Vulnerability Description
The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory. An unprivileged local user can exploit this use-after-free to escalate privileges.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
释放后使用
Source: NVD (National Vulnerability Database)
Vulnerability Title
FreeBSD 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeBSD是FreeBSD基金会开源的一套类Unix操作系统。 FreeBSD存在资源管理错误漏洞，该漏洞源于IPV6_MSFILTER内核处理程序释放序列化锁后未正确处理，可能导致释放后重用，本地低权限用户可利用此漏洞提升权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-49412
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49412
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49412 (1)
Same Patch Batch · FreeBSD · 2026-06-27 · 7 CVEs total
| CVE-2026-49416 | Integer overflow in vt(4) CONS_HISTORY ioctl | |
| CVE-2026-49414 | ASLR bypass for setuid executables via procctl(2) | |
| CVE-2026-49413 | Flaw in Linuxulator execution of setugid binaries | |
| CVE-2026-45259 | sigqueue(2) missing capability mode restriction | |
| CVE-2026-45258 | Multiple vulnerabilities in the sound(4) mmap path | |
| CVE-2026-49417 | Multiple vulnerabilities in the sound(4) mmap path |
IV. Related Vulnerabilities
Same product: FreeBSD
- CVE-2026-49416
Integer overflow in vt(4) CONS_HISTORY ioctl - CVE-2026-49414
ASLR bypass for setuid executables via procctl(2) - CVE-2026-49413
Flaw in Linuxulator execution of setugid binaries - CVE-2026-45259
sigqueue(2) missing capability mode restriction - CVE-2026-45258
Multiple vulnerabilities in the sound(4) mmap path
Same vendor: FreeBSD
- CVE-2026-49416
Integer overflow in vt(4) CONS_HISTORY ioctl - CVE-2026-49414
ASLR bypass for setuid executables via procctl(2) - CVE-2026-49413
Flaw in Linuxulator execution of setugid binaries - CVE-2026-45259
sigqueue(2) missing capability mode restriction - CVE-2026-45258
Multiple vulnerabilities in the sound(4) mmap path
Same weakness: CWE-416
V. Comments for CVE-2026-49412
No comments yet