What happened
Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.
Affected versions
FreeBSD: 14.1-RELEASE through before p4 (release); 14.0-RELEASE through before p10 (release); 13.3-RELEASE through before p6 (release); 14.1 through before 14.1_p4 (custom); 14.0 through before 14.0_p10 (custom); 13.3 through before 13.3_p6 (custom) Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.