CVE-2026-49425: Kernel stack disclosure in 32-bit compatibility support
Published Aug 19, 2026
·Updated
The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct.
An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information.
Event History
Aug 19, 2026
CVE Published
via MITRE·07:11 AM
Data Sourced
via MITRE·07:11 AM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An unprivileged user can trigger the affected compat32 kevent() handler and may observe a small amount of uninitialized kernel stack data.