Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2026-49424

Kernel stack disclosure in Linux compatibility layer

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.0-RELEASE to < p11affected
  • 14.4-RELEASE to < p7affected
  • 14.3-RELEASE to < p16affected

References