CVE-2026-49413: FreeBSD Linuxulator Privilege Escalation via LD_PRELOAD Injection

Technical summary

The vulnerability stems from a logic error in how FreeBSD's Linuxulator sets the AT_SECURE flag in the auxiliary vector during binary execution. The Linuxulator checks the P_SUGID process flag to determine if a binary has the set-user-ID (SUID) or set-group-ID (SGID) bits set, but this check occurs during execve(2) before the P_SUGID flag is actually populated. Consequently, AT_SECURE is incorrectly initialized to zero for SUID/SGID executables. When AT_SECURE is zero, the runtime linker does not restrict environment variables like LD_PRELOAD, allowing an unprivileged user to preload arbitrary shared libraries. The injected library executes with the elevated privileges of the SUID/SGID binary, bypassing the intended privilege boundary. This is rooted in CWE-266 (Incorrect Privilege Assignment), where the system fails to properly enforce privilege restrictions during process execution.

Business impact

Organizations running FreeBSD in production environments that execute Linux binaries with set-user-ID or set-group-ID permissions face a critical local privilege escalation risk. A standard, unprivileged user on the system can gain the privileges of any such binary—potentially escalating to root or other privileged accounts depending on the vulnerable executables present. This undermines system compartmentalization and increases the blast radius of any compromise. Security posture depends on the prevalence of SUID/SGID Linux binaries in the deployment; containerized environments may see less exposure. Recovery requires patching the Linuxulator and restarting affected services.

Affected systems

FreeBSD systems are affected. The vulnerability specifically impacts the Linuxulator feature, which must be enabled and in use for exploitation to be possible. The attacker must have local access to the system and the ability to execute commands as an unprivileged user. Only Linux binaries running with set-user-ID or set-group-ID permissions are vulnerable; standard Linux binaries and native FreeBSD binaries are not affected by this issue.

Exploitability

This vulnerability has a low barrier to exploitation. An unprivileged local attacker with shell access can craft a simple exploit: identify a SUID/SGID Linux binary in the system's PATH or in a common location, create a malicious shared library with the same name as a library the target binary depends on, set LD_PRELOAD to point to the malicious library, and execute the target binary. The injected code runs immediately with the binary's elevated privileges. No special tools, kernel knowledge, or race conditions are required. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) reflects this straightforward local attack path, though exploitation remains limited to systems with the Linuxulator enabled and vulnerable SUID/SGID Linux binaries present.

Remediation

Apply the FreeBSD security patch that corrects the timing of the P_SUGID flag check, ensuring AT_SECURE is properly set before the auxiliary vector is constructed. Verify the patch against the official FreeBSD security advisories to obtain the exact patch version and branch. After patching, restart services that execute Linux binaries or reboot the system to ensure the corrected Linuxulator code is in use. Alternatively, as a temporary mitigation, audit your system for Linux binaries with SUID/SGID permissions and consider removing or replacing those that are not essential, or restricting their use via file permissions or capsicum sandboxing.

Patch guidance

Check the FreeBSD security advisory corresponding to this CVE for the specific patch version and affected FreeBSD releases. Apply patches to all FreeBSD systems using the Linuxulator feature. Verify patch application by confirming the modified source files in the kernel or by observing the version change in your FreeBSD update logs. If you maintain a custom kernel, rebuild with the patched Linuxulator code. Test in a staging environment if possible to confirm that patching does not interfere with legitimate Linux binary execution.

Detection guidance

Monitor for suspicious uses of LD_PRELOAD in process execution logs, particularly when invoked by unprivileged users launching SUID/SGID binaries. Use FreeBSD audit(4) facilities to log execve(2) calls and track environment variables. Check system logs for instances of unusual shared library loading. Periodically audit the filesystem for Linux binaries with SUID/SGID bits set (find / -type f -perm /4000 -o -perm /2000 on the Linux filesystem tree within FreeBSD). Endpoint Detection and Response (EDR) tools with binary execution visibility can identify attempts to inject libraries into privileged binaries.

Why prioritize this

With a CVSS score of 7.1 (HIGH), this vulnerability warrants urgent attention for any FreeBSD deployment running Linux binaries. The low complexity of exploitation (AC:L) combined with the immediate privilege escalation impact (I:H/A:H) makes it a primary target for local attackers seeking rapid privilege gain. Organizations should prioritize patching all exposed FreeBSD systems, especially those in multi-tenant or shared hosting environments where untrusted users have shell access.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a high-impact local attack. Attack Vector is Local (AV:L) because the attacker must have access to the target system. Attack Complexity is Low (AC:L) because no special conditions or race conditions are needed—LD_PRELOAD injection is a straightforward technique. Privileges Required are Low (PR:L) because any unprivileged user can launch the attack. User Interaction is None (UI:N) because the attack is purely automated. The scope is Unchanged (S:U), as the attack affects only the privilege boundary of the targeted process. Integrity is High (I:H) and Availability is High (A:H) because the attacker gains full code execution within the elevated privilege context. Confidentiality is Not impacted (C:N) directly, though the compromised process may access sensitive data.

Frequently asked questions