When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but… (CVE-2026-49418)

The vulnerability arises from improper handling of physical pages in the kernel when msync(MS_INVALIDATE) is invoked on a mapping of an unmanaged device object. The pages are marked invalid but not removed from the pager's page list, causing the page fault handler to reinsert the page, corrupting the list. Upon object destruction, this leads to a double free of the page. This use-after-free condition can be triggered by an unprivileged local user with access to memory-mapped I/O devices, potentially enabling privilege escalation. The affected objects are limited to a pool of fictitious pages that are not recycled for other uses. No patch or remediation information is provided in the available data.

The vulnerability allows an unprivileged local user to trigger a use-after-free condition in the kernel, which may be exploited to escalate privileges. The corruption involves kernel memory management structures related to device memory mappings. Although the affected pages are from a limited pool, the double free can lead to memory corruption and potential arbitrary code execution in kernel context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict unprivileged local users' access to devices that provide memory-mapped I/O to reduce the risk of exploitation.