CVE-2026-49412: FreeBSD IPv6 Multicast Filter Use-After-Free Privilege Escalation

Technical summary

CVE-2026-49412 is a use-after-free vulnerability (CWE-416) in the FreeBSD kernel's IPv6 socket option handler for IPV6_MSFILTER. The vulnerability arises from a lock-release-reacquire pattern: the kernel drops a serializing lock to perform a copyout operation from userspace (to avoid holding the lock during a potentially slow operation), then reacquires it. Between unlock and relock, a concurrent thread may deallocate the multicast filter structure. The handler then operates on a freed pointer, leading to kernel memory corruption. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack surface, low complexity, and complete compromise of confidentiality, integrity, and availability.

Business impact

This vulnerability directly enables local privilege escalation on affected FreeBSD systems. An unprivileged user account can gain root-level code execution, permitting unauthorized access to sensitive data, system modification, malware installation, and lateral movement within network infrastructure. Organizations running FreeBSD in multi-tenant or defense-in-depth environments face significant risk, particularly on systems where local users have shell access (development servers, CI/CD infrastructure, shared hosting). The impact extends beyond the immediate host to potential compromise of adjacent systems and data.

Affected systems

FreeBSD is affected across multiple versions. Consult the official FreeBSD security advisory and your vendor patch tracker for the specific version ranges requiring updates. This vulnerability requires local code execution capability, so systems with tightly controlled local access (single-user appliances, containers with restricted user namespaces) face lower risk than multi-user systems.

Exploitability

Exploitation requires local access and unprivileged user privileges (no setuid or special capabilities needed). The attack vector is straightforward: invoke the IPV6_MSFILTER socket option with crafted parameters while a concurrent thread races to delete the filter. The low complexity reflects that no special kernel knowledge or ASLR bypass is required—the vulnerability is deterministic under the right timing conditions. This makes it highly exploitable by any local user and explains the absence from CISA's Known Exploited Vulnerabilities (KEV) catalog at publication; however, proof-of-concept code may emerge rapidly given the straightforward nature of the flaw.

Remediation

Apply the FreeBSD security patch issued by the vendor. Verify the specific patch version against the official FreeBSD security advisory for your release branch. If patching is delayed, restrict local shell access to trusted users only and consider isolating affected systems from untrusted networks. System monitoring should flag unexpected privilege escalation events.

Patch guidance

Visit the FreeBSD Security Advisories page and match your FreeBSD version to the corresponding errata notice. Download and apply the patch using FreeBSD's standard update procedures (e.g., freebsd-update or source patching). Test in a non-production environment first. Verify the patch by checking the kernel build date and running system diagnostics to confirm the multicast filter handler is no longer vulnerable. Coordinate patching to minimize service disruption.

Detection guidance

Monitor system logs for unexpected privilege escalation attempts, particularly from unprivileged user accounts spawning root-owned processes. Watch for socket creation/manipulation activity involving IPv6 options (IPV6_MSFILTER) paired with unusual thread creation or rapid process forking. Kernel address sanitizer (KASAN) builds will catch use-after-free memory access if available in your test environment. Runtime kernel debugging may reveal heap corruption or fault messages related to multicast filter structures.

Why prioritize this

This vulnerability merits immediate attention despite no current active exploitation in the wild. Local privilege escalation flaws are particularly dangerous because they are foundational to supply-chain attacks, insider threats, and post-compromise persistence. The low exploitation complexity and high impact (complete system compromise) create asymmetric risk: a single vulnerable system in a fleet can be weaponized rapidly. Organizations should prioritize patching all FreeBSD systems with local user access, with particular urgency for multi-user or development infrastructure.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is driven by: (1) Local attack vector—attacker must have login access; (2) Low attack complexity—no special conditions or knowledge required; (3) Low privilege requirement—unprivileged user suffices; (4) No user interaction needed; (5) Complete impact on confidentiality, integrity, and availability. The score appropriately reflects the severity of kernel-level code execution but is moderated by the local-only attack surface. In environments where local access is tightly controlled, risk is lower; in multi-tenant or permissive environments, operational risk may exceed the numeric score.

Frequently asked questions