← Back

CVE-2026-49424

nvd nist
Published: Aug 19, 2026Modified: Aug 31, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.

Affected (35)

Products: Freebsd: Freebsd
Freebsd
1 product
Freebsd
Configuration A
35 vulnerable
Vulnerable SoftwareAffected Versions
Freebsd
Freebsd
Version 14.3
Freebsd
Version 14.3 p10
Freebsd
Version 14.3 p11
Freebsd
Version 14.3 p12
Freebsd
Version 14.3 p13
Freebsd
Version 14.3 p14
Freebsd
Version 14.3 p15
Freebsd
Version 14.3 p1
Freebsd
Version 14.3 p2
Freebsd
Version 14.3 p3
Freebsd
Version 14.3 p4
Freebsd
Version 14.3 p5
Freebsd
Version 14.3 p6
Freebsd
Version 14.3 p7
Freebsd
Version 14.3 p8
Freebsd
Version 14.3 p9
Freebsd
Version 14.4
Freebsd
Version 14.4 p1
Freebsd
Version 14.4 p2
Freebsd
Version 14.4 p3
Freebsd
Version 14.4 p4
Freebsd
Version 14.4 p5
Freebsd
Version 14.4 p6
Freebsd
Version 14.4 rc1
Freebsd
Version 15.0
Freebsd
Version 15.0 p10
Freebsd
Version 15.0 p1
Freebsd
Version 15.0 p2
Freebsd
Version 15.0 p3
Freebsd
Version 15.0 p4
Freebsd
Version 15.0 p5
Freebsd
Version 15.0 p6
Freebsd
Version 15.0 p7
Freebsd
Version 15.0 p8
Freebsd
Version 15.0 p9

Related CWEs

CWE-908
Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.

References (1)

Source: secteam@freebsd.org
Vendor Advisory

Timeline

No history available yet.