CVE-2026-6386: Kernel Privilege Escalation in FreeBSD

The vulnerability stems from an error in how the kernel handles largepage mappings created with shmcreatelargepage(3). Specifically, the pmappkruupdate_range() function incorrectly treats userspace memory as a page table page. This misinterpretation allows an attacker to overwrite memory locations that would normally be inaccessible, effectively bypassing memory protection mechanisms. Successful exploitation could grant an attacker root privileges, enabling them to install malware, steal sensitive data, or completely control the affected system. The potential impact is significant, particularly in multi-user environments where an attacker could compromise other user accounts.

1. Reserved2026-04-15
2. Published2026-04-22
3. EPSS updated2026-04-29

The primary mitigation is to upgrade to FreeBSD Kernel 13.5-RELEASE–p12, which contains the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to the shmcreatelargepage(3) interface. Monitoring system logs for unusual memory access patterns can also help detect potential exploitation attempts. After upgrading, confirm the fix by attempting to reproduce the vulnerability using known exploit techniques and verifying that the memory protection mechanisms are functioning as expected.