CVE-2026-49425
N/A
N/A
Summary
The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct.
An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| FreeBSD | FreeBSD | 15.0-RELEASE < p11 | affected |
| FreeBSD | FreeBSD | 14.4-RELEASE < p7 | affected |
| FreeBSD | FreeBSD | 14.3-RELEASE < p16 | affected |
Weaknesses
- CWE-908: CWE-908: Use of Uninitialized Resource
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.