CVE-2026-49425CWE-908

CVE-2026-49425

Medium · published August 19, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
3.9
In the wild
Unconfirmed
What it is

The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct.

An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00151 · 3.9th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2026-08-19T12:17Z
Affected products (35)
ProductVersionsFixed in
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
freebsd/freebsdall versions—
References (1)
https://security.freebsd.org/advisories/FreeBSD-SA-26:48.compat32.asc · [email protected]
EPSS history
Timeline
  • 19 AUG 07:11Z
    Kernel stack disclosure in 32-bit compatibility support
    cvelistv5