CVE-2026-49425: Kernel stack disclosure in 32-bit compatibility support
Published Aug 19, 2026
·Updated
The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct.
An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information.
Affected Software
36 affected components
Linux Kernel
FreeBSD FreeBSD=14.3
FreeBSD FreeBSD=14.3-p1
FreeBSD FreeBSD=14.3-p10
FreeBSD FreeBSD=14.3-p11
FreeBSD FreeBSD=14.3-p12
FreeBSD FreeBSD=14.3-p13
FreeBSD FreeBSD=14.3-p14
FreeBSD FreeBSD=14.3-p15
FreeBSD FreeBSD=14.3-p2
FreeBSD FreeBSD=14.3-p3
FreeBSD FreeBSD=14.3-p4
FreeBSD FreeBSD=14.3-p5
FreeBSD FreeBSD=14.3-p6
FreeBSD FreeBSD=14.3-p7
FreeBSD FreeBSD=14.3-p8
FreeBSD FreeBSD=14.3-p9
FreeBSD FreeBSD=14.4
FreeBSD FreeBSD=14.4-p1
FreeBSD FreeBSD=14.4-p2
FreeBSD FreeBSD=14.4-p3
FreeBSD FreeBSD=14.4-p4
FreeBSD FreeBSD=14.4-p5
FreeBSD FreeBSD=14.4-p6
FreeBSD FreeBSD=14.4-rc1
FreeBSD FreeBSD=15.0
FreeBSD FreeBSD=15.0-p1
FreeBSD FreeBSD=15.0-p10
FreeBSD FreeBSD=15.0-p2
FreeBSD FreeBSD=15.0-p3
FreeBSD FreeBSD=15.0-p4
FreeBSD FreeBSD=15.0-p5
FreeBSD FreeBSD=15.0-p6
FreeBSD FreeBSD=15.0-p7
FreeBSD FreeBSD=15.0-p8
FreeBSD FreeBSD=15.0-p9
Event History
Aug 19, 2026
CVE Published
via MITRE·07:11 AM
Data Sourced
via MITRE·07:11 AM
DescriptionWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An unprivileged user can trigger the affected compat32 kevent() handler and may observe a small amount of uninitialized kernel stack data.