Linux Kernel waitid() data leak via un-zeroed siginfo_t
CVE-2026-49424 Published on August 19, 2026
Kernel stack disclosure in Linux compatibility layer
The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct.
An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.
Vulnerability Analysis
CVE-2026-49424 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Use of Uninitialized Resource
The software uses or accesses a resource that has not been initialized. When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.
Products Associated with CVE-2026-49424
Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.
Affected Versions
FreeBSD:- Version 15.0-RELEASE and below p11 is affected.
- Version 14.4-RELEASE and below p7 is affected.
- Version 14.3-RELEASE and below p16 is affected.