Kernel stack disclosure in Linux compatibility layer
FreeBSD-SA-26:47.linux · CVE-2026-49424
Our decision for FreeSense
FreeBSD corrected this on 2026-03-20, before the FreeBSD source pin of every FreeSense version.
- Advisory: corrected 2026-03-20
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | FixedFreeBSD pin of 2026-08-03 | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available, but systems not using the Linux binary compatibility layer are not vulnerable. The Linux compatibility layer is not included in the default GENERIC kernel. The following command can be used to test if the Linux binary compatibility layer is loaded: # kldstat -m linuxelf
What FreeBSD says
The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct.
Impact
An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.