CVE-2026-49424 in FreeBSD
Summary
by MITRE • 08/19/2026
The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct.
An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability in question stems from an implementation flaw within the Linux waitid() system call interface when handling signals originating from FreeBSD compatibility layers or specific emulation contexts. The core technical issue lies in how the kernel translates a siginfo_t structure from the FreeBSD format into the native Linux siginfo_t format before returning it to user space. Specifically, the code allocates a stack-based buffer for the destination Linux struct but fails to initialize this memory region prior to copying data into it. In C programming and systems development, local variables declared on the kernel stack are not automatically zeroed out by default unless explicitly done so via functions like memset or kzalloc. This omission means that any fields within the siginfo_t structure that are not populated during the translation process will retain whatever residual data previously existed in those memory locations from prior kernel operations.
This lack of initialization results in a classic information disclosure vulnerability, often categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor or more specifically as CWE-789: Memory Leak leading to Information Disclosure via uninitialized variables. When the waitid() system call completes its operation and returns control to the user-space application, it copies the contents of this stack buffer back to the caller. Because the buffer was not cleared, any bytes in the siginfo_t structure that were not explicitly written during the translation process are copied verbatim from their previous state on the kernel stack. An unprivileged user can invoke this system call repeatedly and analyze the returned data structures to identify patterns or specific values that correspond to sensitive information currently residing in those memory slots.
The operational impact of this flaw is significant because it allows an attacker with low-level access, such as a standard non-root user account on a Linux system running FreeBSD emulation layers like linux_binfmt or similar compatibility modules, to leak kernel stack contents. The affected area comprises approximately 104 bytes of uninitialized data. While the exact nature of the leaked information depends on what was previously stored in that specific region of the kernel stack at the time of execution, it can potentially include pointers to other kernel structures, cryptographic keys, session tokens, or credentials used by previous system calls handled by the same CPU core and memory page. This aligns with ATT&CK technique T1083: File and Directory Discovery if the leaked data aids in further enumeration, but more accurately fits under information gathering techniques that exploit memory state inconsistencies to bypass access controls implicitly through data leakage rather than explicit privilege escalation.
Mitigation for this vulnerability requires a code-level fix within the Linux kernel source where the waitid() implementation resides. The primary remediation is to ensure that any stack-allocated structure used as an intermediate buffer during system call processing is explicitly zeroed out before being populated with new data. This can be achieved by using memset on the destination struct immediately after allocation or declaration, ensuring all bytes are set to null values prior to the translation logic executing. Additionally, developers should audit similar patterns in other compatibility layers and signal handling routines where structures of varying sizes between host and guest operating systems are translated. For system administrators unable to apply an immediate kernel patch, restricting access to environments that utilize FreeBSD emulation or disabling specific legacy binary formats can reduce the attack surface until a full update is deployed. Regular security audits focusing on memory initialization practices in low-level C code within the kernel are essential to prevent similar uninitialized variable leaks across other subsystems.