Vulnerability · Published Jun 27, 2026 · Assigned by freebsd

CVE-2026-49413Flaw in Linuxulator execution of setugid binaries

High 7.1

In plain English

A high-severity security flaw in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.1%top 97.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-group-ID Linux binary, gaining the privileges of that binary.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	15.0-RELEASE – before p1014.4-RELEASE – before p614.3-RELEASE – before p15

Weakness: CWE-266 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:30.linux.asc vendor-advisory