-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-26:47.linux Security Advisory
The FreeBSD Project
Topic: Kernel stack disclosure in Linux compatibility layer
Category: core
Module: linux(4)
Announced: 2026-06-30
Credits: Adam Crosser, Praetorian
Affects: FreeBSD 14.3, FreeBSD 14.4 and FreeBSD 15.0
Corrected: 2026-03-20 13:36:36 UTC (stable/15, 15.0-STABLE)
2026-06-30 17:21:34 UTC (releng/15.0, 15.0-RELEASE-p11)
2026-03-20 13:37:14 UTC (stable/14, 14.4-STABLE)
2026-06-30 17:21:07 UTC (releng/14.4, 14.4-RELEASE-p7)
2026-06-30 17:20:41 UTC (releng/14.3, 14.3-RELEASE-p16)
CVE Name: CVE-2026-49424
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
The Linux ABI layer (Linuxulator) allows Linux binaries to be executed on a
FreeBSD kernel. This compatibility layer is supported on the amd64, aarch64
and i386 architectures.
II. Problem Description
The Linux waitid() implementation translates a FreeBSD siginfo_t struct
into a stack-declared Linux siginfo_t. It did not first zero the stack
struct.
III. Impact
An unprivileged user may observe 104 bytes of uninitialized kernel stack
data, which may contain sensitive information.
IV. Workaround
No workaround is available, but systems not using the Linux binary
compatibility layer are not vulnerable.
The Linux compatibility layer is not included in the default GENERIC kernel.
The following command can be used to test if the Linux binary compatibility
layer is loaded:
# kldstat -m linuxelf
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.
Perform one of the following:
1) To update your vulnerable system installed from base system packages:
Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:
# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-26:47/linux.patch
# fetch https://security.FreeBSD.org/patches/SA-26:47/linux.patch.asc
# gpg --verify linux.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch -E -p0 < /path/to/patch
c) Recompile your kernel as described in
and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ 9f8db9cc67fb stable/15-n282671
releng/15.0/ 008ca5def63b releng/15.0-n281080
stable/14/ a347e6e20e75 stable/14-n273828
releng/14.4/ 99d936f98589 releng/14.4-n273740
releng/14.3/ 6d0438693721 releng/14.3-n271540
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat
Or visit the following URL, replacing NNNNNN with the hash:
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmpEElQbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrveFIQAMbywS1crIKLqntgDjOA
VHkUEsq7B3MGFnx8BfEDLZ/IubBmXpUsqYjA2mGy/4dZhnIKWq280RUAK/fXpTRU
NhXJtaaeRfq/rOOGLdiTozltDohiPWUHZ1ITyZICJsfTbNaFHFGvRNNnVcWTJh3T
15D6/j8tJMbRccAK+Bb3mjWBP5wkxtRvZ8wDFqmem7TYg+em742ZYBxMJyV8DJat
LzsRfOk7WV5lh+h0zLl5qlsYbr8WqYwxY+l2L+qVsmtuLRTy26Fx1qSivxPDjQjg
erQRy/UeudTkzQpKpVHcNmier1TW349ZyQrL+5ZB2A1+UvhBnPMztiAu8ubtxC2j
cZNnK9b/tesd6fubKtSvg+xFFzsAM6/vLwLVoMFkdGCw9hA4Z/+53uGqqaSN+KqJ
n6BaZ7kyQowYxAwvOWnN0h3zrmRBueB+C2zPwwOo6vDptZJNcj5omssjg3KYZ0/3
bqVbA3VEhWsY4sKjh637h0m/R92fYynjcduRYhSw3pbMXmA0SROKpdTxMgnrHEXG
vViKW0cOHVRZDNZqDcI5YzfvPlXMEdAvrkWrlxvqyQOeTWei7dPLQiPKFxe/6SeQ
3qICnzzVgOkZDdjs44ued+10FacDCB6M1ixU0uPcWfoPaR79rQdNzQ8mpS1p0vbS
ixppeXaxrot6sTGKW4n7V5ek
=xA+Q
-----END PGP SIGNATURE-----