CVE-2026-49424

Published: Ago 19, 2026 Last Modified: Ago 19, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct.

An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.

908

Use of Uninitialized Resource

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Availability
Potential Impacts:
Read Memory Read Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://security.freebsd.org/advisories/FreeBSD-SA-26:47.li…
https://security.freebsd.org/advisories/FreeBSD-SA-26:47.linux.asc