Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2026-49425

Kernel stack disclosure in 32-bit compatibility support

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.0-RELEASE to < p11affected
  • 14.4-RELEASE to < p7affected
  • 14.3-RELEASE to < p16affected

References