CVE-2026-49412

EUVD-2026-39964
The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock.  During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory.

An unprivileged local user can exploit this use-after-free to escalate privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.18%
Affected Products (NVD)
VendorProductVersion
freebsdfreebsd
14.3
freebsdfreebsd
14.3:p1
freebsdfreebsd
14.3:p10
freebsdfreebsd
14.3:p11
freebsdfreebsd
14.3:p12
freebsdfreebsd
14.3:p13
freebsdfreebsd
14.3:p14
freebsdfreebsd
14.3:p2
freebsdfreebsd
14.3:p3
freebsdfreebsd
14.3:p4
freebsdfreebsd
14.3:p5
freebsdfreebsd
14.3:p6
freebsdfreebsd
14.3:p7
freebsdfreebsd
14.3:p8
freebsdfreebsd
14.3:p9
freebsdfreebsd
14.4
freebsdfreebsd
14.4:p1
freebsdfreebsd
14.4:p2
freebsdfreebsd
14.4:p3
freebsdfreebsd
14.4:p4
freebsdfreebsd
14.4:p5
freebsdfreebsd
15.0
freebsdfreebsd
15.0:p1
freebsdfreebsd
15.0:p2
freebsdfreebsd
15.0:p3
freebsdfreebsd
15.0:p4
freebsdfreebsd
15.0:p5
freebsdfreebsd
15.0:p6
freebsdfreebsd
15.0:p7
freebsdfreebsd
15.0:p8
freebsdfreebsd
15.0:p9
𝑥
= Vulnerable software versions