What is CVE-2026-49419?
CVE-2026-49419 is a double-free vulnerability in FreeBSD kernel functions `kern_jail_set()` and `kern_jail_get()` when the JAIL_AT_DESC flag is used. An unprivileged local user can trigger a second release of a prison reference on descriptor lookup failure, potentially causing denial of service (DoS) or arbitrary code execution. Affected FreeBSD versions should apply the security patch immediately.
Azərbaycanca: CVE-2026-49419 FreeBSD nüvəsində (kernel) `kern_jail_set()` və `kern_jail_get()` funksiyalarında ikiqat yaddaş azadetmə (double free) zəifliyidir. Bu, JAIL_AT_DESC bayrağı istifadə edildikdə baş verir və imtiyazsız yerli istifadəçiyə sistemin çökməsinə (DoS) və ya potensial olaraq kod icrasına səbəb ola bilər. Təsirə məruz qalan FreeBSD versiyalarında dərhal təhlükəsizlik yaması tətbiq edilməlidir.
Related CVEs
link basis: same weakness class CWE-416
FAQ2
Which functions are affected by CVE-2026-49419 in FreeBSD, and what is the role of the JAIL_AT_DESC flag?
CVE-2026-49419 is a double-free vulnerability in the FreeBSD kernel functions `kern_jail_set()` and `kern_jail_get()`. The vulnerability occurs when the JAIL_AT_DESC flag is used.
What risks can an unprivileged local user cause by exploiting CVE-2026-49419?
An unprivileged local user can trigger a second release of a prison reference on descriptor lookup failure, potentially causing denial of service (DoS) or arbitrary code execution.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.