Problem Description:
Pages belonging to largepage shared memory objects were not
explicitly wired. When sendfile(2) transmitted such an object with
the SF_NOCACHE flag, it freed the underlying pages after transmission
even though existing mappings still referred to them. [CVE-2026-49427]
Separately, certain system calls, such open(2) with the O_TRUNC
flag set, and fspacectl(2), could incorrectly free memory in largepage
objects. These operations are not permitted on largepage objects,
but the implementation did not verify this. [CVE-2026-49428]
Impact:
An unprivileged local user can abuse the bug to access freed
kernel memory. This can be exploited to escalate privileges.