-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

============================================================================= FreeBSD-SA-26:47.linux Security Advisory
The FreeBSD Project

Topic: Kernel stack disclosure in Linux compatibility layer

Category: core
Module: linux(4)
Announced: 2026-06-30
Credits: Adam Crosser, Praetorian
Affects: FreeBSD 14.3, FreeBSD 14.4 and FreeBSD 15.0
Corrected: 2026-03-20 13:36:36 UTC (stable/15, 15.0-STABLE)
2026-06-30 17:21:34 UTC (releng/15.0, 15.0-RELEASE-p11)
2026-03-20 13:37:14 UTC (stable/14, 14.4-STABLE)
2026-06-30 17:21:07 UTC (releng/14.4, 14.4-RELEASE-p7)
2026-06-30 17:20:41 UTC (releng/14.3, 14.3-RELEASE-p16)
CVE Name: CVE-2026-49424

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

I. Background

The Linux ABI layer (Linuxulator) allows Linux binaries to be executed on a FreeBSD kernel. This compatibility layer is supported on the amd64, aarch64 and i386 architectures.

II. Problem Description

The Linux waitid() implementation translates a FreeBSD siginfo_t struct
into a stack-declared Linux siginfo_t. It did not first zero the stack
struct.

III. Impact

An unprivileged user may observe 104 bytes of uninitialized kernel stack
data, which may contain sensitive information.

IV. Workaround

No workaround is available, but systems not using the Linux binary compatibility layer are not vulnerable.

The Linux compatibility layer is not included in the default GENERIC kernel.

The following command can be used to test if the Linux binary compatibility layer is loaded:

# kldstat -m linuxelf

V. Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.

Perform one of the following:

1) To update your vulnerable system installed from base system packages:

Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility:

# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"

2) To update your vulnerable system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-26:47/linux.patch
# fetch https://security.FreeBSD.org/patches/SA-26:47/linux.patch.asc
# gpg --verify linux.patch.asc

b) Apply the patch. Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI. Correction details

This issue is corrected as of the corresponding Git commit hash in the following stable and release branches:

Branch/path Hash Revision
- ------------------------------------------------------------------------- stable/15/ 9f8db9cc67fb stable/15-n282671 releng/15.0/ 008ca5def63b releng/15.0-n281080 stable/14/ a347e6e20e75 stable/14-n273828 releng/14.4/ 99d936f98589 releng/14.4-n273740 releng/14.3/ 6d0438693721 releng/14.3-n271540
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://www.cve.org/CVERecord?id=CVE-2026-49424>

The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:47.linux.asc> -----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmpEElQbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrveFIQAMbywS1crIKLqntgDjOA VHkUEsq7B3MGFnx8BfEDLZ/IubBmXpUsqYjA2mGy/4dZhnIKWq280RUAK/fXpTRU NhXJtaaeRfq/rOOGLdiTozltDohiPWUHZ1ITyZICJsfTbNaFHFGvRNNnVcWTJh3T 15D6/j8tJMbRccAK+Bb3mjWBP5wkxtRvZ8wDFqmem7TYg+em742ZYBxMJyV8DJat LzsRfOk7WV5lh+h0zLl5qlsYbr8WqYwxY+l2L+qVsmtuLRTy26Fx1qSivxPDjQjg erQRy/UeudTkzQpKpVHcNmier1TW349ZyQrL+5ZB2A1+UvhBnPMztiAu8ubtxC2j cZNnK9b/tesd6fubKtSvg+xFFzsAM6/vLwLVoMFkdGCw9hA4Z/+53uGqqaSN+KqJ n6BaZ7kyQowYxAwvOWnN0h3zrmRBueB+C2zPwwOo6vDptZJNcj5omssjg3KYZ0/3 bqVbA3VEhWsY4sKjh637h0m/R92fYynjcduRYhSw3pbMXmA0SROKpdTxMgnrHEXG vViKW0cOHVRZDNZqDcI5YzfvPlXMEdAvrkWrlxvqyQOeTWei7dPLQiPKFxe/6SeQ 3qICnzzVgOkZDdjs44ued+10FacDCB6M1ixU0uPcWfoPaR79rQdNzQ8mpS1p0vbS ixppeXaxrot6sTGKW4n7V5ek
=xA+Q
-----END PGP SIGNATURE-----


--- PyGate Linux v1.5.18
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)