CVE-2026-49424: Linux Kernel Information Disclosure Flaw

CVE-2026-49424 Overview

CVE-2026-49424 is an information disclosure vulnerability in the FreeBSD Linux compatibility layer. The Linux waitid() implementation translates a FreeBSD siginfo_t structure into a stack-declared Linux siginfo_t without first zeroing the destination buffer. An unprivileged local user invoking waitid() through the Linux ABI can read 104 bytes of uninitialized kernel stack memory. This memory may contain sensitive data left behind by prior kernel operations, including pointers, credentials, or fragments of privileged process state. The flaw is classified as [CWE-908] Use of Uninitialized Resource.

Critical Impact
Unprivileged local users can leak 104 bytes of uninitialized kernel stack memory per call, potentially exposing sensitive kernel state and defeating address space layout randomization.

Affected Products

FreeBSD operating system with the Linux compatibility layer (linux.ko) enabled
FreeBSD systems running Linux binaries through the Linuxulator ABI
Refer to the FreeBSD Security Advisory for specific affected releases and errata levels

Discovery Timeline

2026-08-19 - CVE-2026-49424 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49424

Vulnerability Analysis

The FreeBSD kernel provides a Linux ABI compatibility layer that allows unmodified Linux binaries to run on FreeBSD. When a Linux process invokes the waitid() system call, the kernel translates FreeBSD's native siginfo_t structure into the Linux-format siginfo_t before copying it to user space.

The translation routine declares the Linux siginfo_t structure on the kernel stack. The FreeBSD-to-Linux conversion writes specific fields required by the Linux ABI but does not write to every byte of the destination structure. Because the stack buffer is never initialized, bytes not touched by the translation retain whatever data previously occupied that stack region.

The kernel then copies the entire structure to user space using copyout() or equivalent. This exposes 104 bytes of uninitialized kernel stack contents to the calling process. Attackers can chain this primitive with other techniques to leak kernel pointers, defeat KASLR, or harvest sensitive kernel state.

Root Cause

The root cause is a missing memory initialization step in the Linux compatibility layer's signal information translation code. The stack-allocated Linux siginfo_t is populated field-by-field, but the compiler does not zero-initialize local variables in C. Any padding bytes, reserved fields, or union members not explicitly written by the translation function retain stale stack contents. A bzero() or memset() call on the structure before field population would eliminate the leak.

Attack Vector

Exploitation requires local access and the ability to execute Linux binaries under the FreeBSD Linuxulator. An unprivileged attacker calls waitid() from a Linux process and reads the returned siginfo_t. The 104 leaked bytes vary based on prior kernel stack activity. Attackers typically prime the stack by triggering deep kernel call paths, then invoke the leaky syscall to capture predictable residual data. Repeated invocations can build a picture of kernel memory layout without triggering crashes or generating obvious log entries.

See the FreeBSD Security Advisory for the authoritative technical description.

Detection Methods for CVE-2026-49424

Indicators of Compromise

Unexpected use of the FreeBSD Linux compatibility layer by non-administrative users, particularly processes invoking waitid() with unusual argument patterns
Repeated waitid() invocations from short-lived Linux ABI processes without matching fork() or clone() activity
Presence of reconnaissance tooling under /compat/linux or user-writable paths that references Linuxulator-specific syscalls

Detection Strategies

Audit system call activity for Linux ABI processes using dtrace probes on linux_waitid and correlate with process lineage
Monitor loaded kernel modules to confirm whether linux.ko is required in your environment; unnecessary presence expands attack surface
Establish baselines for legitimate Linuxulator usage and alert on new binaries invoking the Linux syscall table

Monitoring Recommendations

Forward FreeBSD auditd logs covering syscall class ex and process execution to a centralized analytics platform
Track kernel panic and page fault telemetry that may correlate with follow-on exploitation of leaked pointers
Review privileged process memory access patterns following observed waitid() bursts from unprivileged users

How to Mitigate CVE-2026-49424

Immediate Actions Required

Apply the FreeBSD security patch referenced in FreeBSD-SA-26:47.linux as soon as vendor updates are available for your release
Inventory hosts with the Linux compatibility layer loaded and prioritize patching multi-user or shared systems
Restrict execution of untrusted Linux binaries on FreeBSD hosts until patches are applied

Patch Information

FreeBSD publishes patched kernels and source updates through its standard advisory process. Apply the update via freebsd-update fetch install on supported releases, or rebuild the kernel from the corrected source. Reboot after applying the update to load the patched linux.ko module. Consult the FreeBSD Security Advisory for exact patch levels and errata identifiers.

Workarounds

Unload the Linux compatibility module with kldunload linux and kldunload linux64 on systems that do not require Linuxulator functionality
Remove linux_enable="YES" from /etc/rc.conf to prevent the module from loading at boot
Restrict access to /compat/linux and prevent unprivileged users from executing Linux binaries using filesystem permissions or MAC policies

bash

# Disable the FreeBSD Linux compatibility layer if not required
sysrc linux_enable="NO"
kldunload linux64
kldunload linux

# Confirm the module is no longer loaded
kldstat | grep -i linux