CVE-2026-49424: Kernel stack disclosure in Linux compatibility layer
Published Aug 19, 2026
·Updated
The Linux waitid() implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct.
An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.
Affected Software
1 affected component
Linux waitid() implementation
Event History
Aug 19, 2026
CVE Published
via MITRE·07:08 AM
Data Sourced
via MITRE·07:08 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can trigger the disclosure?
An unprivileged user can trigger it through the Linux compatibility layer's waitid() implementation.
2
What information may be exposed?
The issue may disclose 104 bytes of uninitialized kernel stack data. That data may contain sensitive information.