Loading vulnerability…
CVE-2026-49413 is a local privilege-escalation vulnerability in FreeBSD's Linuxulator. When executing set-user-ID or set-group-ID Linux binaries under Linux emulation, the Linuxulator determined privileged execution state by checking the P_SUGID process flag. During execve(2), that flag had not yet been set at the time the auxiliary vector was constructed, causing AT_SECURE to be incorrectly set to 0 for setuid/setgid Linux executables. As a result, the runtime linker did not enter secure mode and unsafe environment-controlled behavior remained enabled. An unprivileged local user could exploit this by supplying LD_PRELOAD to force loading of an attacker-controlled shared library into a privileged Linux binary, thereby executing code with the privileges of that binary.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single C proof-of-concept exploit (exploit.c) plus a minimal README image. The exploit is a local privilege escalation tool targeting FreeBSD systems running the Linux compatibility layer ('Linuxulator'). Its workflow is structured in three phases: (1) environment validation, where it checks for loaded linux/linux64 kernel modules, verifies the presence of the Linux dynamic loader under /compat/linux/, and searches a hardcoded list of candidate Linux binaries for a setuid-root target; (2) vulnerability verification, where it executes the chosen target with LD_SHOW_AUXV=1 and parses output for AT_SECURE to determine whether the runtime incorrectly leaves AT_SECURE=0; and (3) exploitation, where it writes a malicious shared-library source file to /tmp/.poc_evil.c, compiles it into /tmp/.poc_evil.so using cc -shared -fPIC -nostdlib, brands it as a Linux ELF with brandelf, sets LD_PRELOAD to that library, and execs the target binary. The embedded payload is a constructor function that runs before the target program, checks whether effective UID is 0, then sets real/effective IDs to 0 and execves /bin/sh, yielding a root shell. No network communication or remote C2 is present; all observables are local filesystem paths and kernel module names. This is a real exploit PoC rather than a detector-only script, and it is operational because it includes a working privilege-escalation payload with limited hardcoded targeting.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A privilege escalation vulnerability affecting FreeBSD's Linuxulator compatibility layer.
A FreeBSD Linuxulator vulnerability involving LD_PRELOAD handling with SUID binaries that may enable privilege escalation.
A privilege-related vulnerability in FreeBSD's Linuxulator compatibility layer involving LD_PRELOAD handling in SUID contexts.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.