Description

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-19T06:17:42.263Z",
  "pubdate": "2026-08-19T06:17:42.263Z",
  "executiveSummary": "A vulnerability exists in the kernel implementation concerning largepage object management, allowing unauthorized memory deallocation via specific system calls.\nThe vulnerability type is improper memory management leading to use-after-free or kernel memory corruption.\nThe primary impact is local privilege escalation, enabling an unprivileged local user to compromise the integrity and security of the affected system.\nAffected systems are those utilizing the vulnerable largepage object handling implementation.\nThe risk implications are severe, as successful exploitation yields arbitrary kernel memory access and subsequent privilege escalation.\nAttacker capabilities are limited to unprivileged local access, requiring local execution context to interact with the target system calls.\nNo specific advanced authentication or network exposure is required, as the attack vector is local.",
  "technicalDetails": "The root cause of the vulnerability stems from the lack of proper validation checks within system call handlers for largepage objects.\nSpecifically, operations such as open(2) with the O_TRUNC flag set and fspacectl(2) are executed on largepage objects without verifying whether these operations are legally permitted on such memory structures.\nBecause the validation is missing, these restricted operations invoke code paths that incorrectly free memory associated with largepage objects.\nAn unprivileged local user can deliberately trigger this behavior by invoking open(2) with O_TRUNC or fspacectl(2) against target largepage memory constructs.\nThe attack flow proceeds as follows: First, the local attacker prepares or identifies a largepage object context. Second, the attacker invokes the disallowed system call, such as open(2) with O_TRUNC or fspacectl(2), targeting the object. Third, the kernel executes the system call handler without enforcing object-type restrictions. Fourth, the kernel incorrectly frees the underlying memory resources of the largepage object while references or management structures may still point to it. Fifth, the attacker interacts with the freed kernel memory location, achieving use-after-free conditions.\nPost-exploitation impact includes the ability to manipulate freed kernel memory, circumvent security controls, and successfully escalate privileges to a higher security context on the host system."
}