CVE-2026-49424: Kernel stack disclosure in Linux compatibility layer
Published Aug 19, 2026
·Updated
The Linux waitid() implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct.
An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.
Affected Software
36 affected components
Linux waitid() implementation
FreeBSD FreeBSD=14.3
FreeBSD FreeBSD=14.3-p1
FreeBSD FreeBSD=14.3-p10
FreeBSD FreeBSD=14.3-p11
FreeBSD FreeBSD=14.3-p12
FreeBSD FreeBSD=14.3-p13
FreeBSD FreeBSD=14.3-p14
FreeBSD FreeBSD=14.3-p15
FreeBSD FreeBSD=14.3-p2
FreeBSD FreeBSD=14.3-p3
FreeBSD FreeBSD=14.3-p4
FreeBSD FreeBSD=14.3-p5
FreeBSD FreeBSD=14.3-p6
FreeBSD FreeBSD=14.3-p7
FreeBSD FreeBSD=14.3-p8
FreeBSD FreeBSD=14.3-p9
FreeBSD FreeBSD=14.4
FreeBSD FreeBSD=14.4-p1
FreeBSD FreeBSD=14.4-p2
FreeBSD FreeBSD=14.4-p3
FreeBSD FreeBSD=14.4-p4
FreeBSD FreeBSD=14.4-p5
FreeBSD FreeBSD=14.4-p6
FreeBSD FreeBSD=14.4-rc1
FreeBSD FreeBSD=15.0
FreeBSD FreeBSD=15.0-p1
FreeBSD FreeBSD=15.0-p10
FreeBSD FreeBSD=15.0-p2
FreeBSD FreeBSD=15.0-p3
FreeBSD FreeBSD=15.0-p4
FreeBSD FreeBSD=15.0-p5
FreeBSD FreeBSD=15.0-p6
FreeBSD FreeBSD=15.0-p7
FreeBSD FreeBSD=15.0-p8
FreeBSD FreeBSD=15.0-p9
Event History
Aug 19, 2026
CVE Published
via MITRE·07:08 AM
Data Sourced
via MITRE·07:08 AM
DescriptionWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can trigger the disclosure?
An unprivileged user can trigger it through the Linux compatibility layer's waitid() implementation.
2
What information may be exposed?
The issue may disclose 104 bytes of uninitialized kernel stack data. That data may contain sensitive information.