CVE-2026-49425 PUBLISHED

Kernel stack disclosure in 32-bit compatibility support

Assigner: freebsd
Reserved: 29.05.2026 Published: 19.08.2026 Updated: 19.08.2026

The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct.

An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information.

Product Status

Vendor FreeBSD
Product FreeBSD
Versions Default: unknown
  • affected from 15.0-RELEASE to p11 (excl.)
  • affected from 14.4-RELEASE to p7 (excl.)
  • affected from 14.3-RELEASE to p16 (excl.)

Credits

  • Adam Crosser, Praetorian finder

References

Problem Types

  • CWE-908: Use of Uninitialized Resource CWE