Missing large page handling in pmap_pkru_update_range()

The vulnerability stems from an error in how the kernel handles largepage mappings created with shmcreatelargepage(3). Specifically, the pmappkruupdate_range() function incorrectly treats userspace memory as a page table page. This misinterpretation allows an attacker to overwrite memory locations that would normally be inaccessible, effectively bypassing memory protection mechanisms. Successful exploitation could grant an attacker root privileges, enabling them to install malware, steal sensitive data, or completely control the affected system. The potential impact is significant, particularly in multi-user environments where an attacker could compromise other user accounts.

Systems running FreeBSD Kernel 13.5-RELEASE–p12 are at risk, particularly those utilizing shared memory segments created with shmcreatelargepage(3). This includes systems hosting multi-user applications or services that rely on shared memory for inter-process communication.

• linux / server:

journalctl -g 'pmap_pkru_update_range' --since "1 day ago"

• linux / server:

auditctl -w /usr/include/sys/pmap.h -p wa -k freebsd_kernel_vuln

• linux / server:

ps aux | grep shm_create_largepage

1. 2026-04-22Disclosure

   disclosure

1. Gereserveerd2026-04-15
2. Gepubliceerd2026-04-22
3. EPSS bijgewerkt2026-04-29

The primary mitigation is to upgrade to FreeBSD Kernel 13.5-RELEASE–p12, which contains the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to the shmcreatelargepage(3) interface. Monitoring system logs for unusual memory access patterns can also help detect potential exploitation attempts. After upgrading, confirm the fix by attempting to reproduce the vulnerability using known exploit techniques and verifying that the memory protection mechanisms are functioning as expected.