From nobody Tue Jun 30 19:56:26 2026 X-Original-To: freebsd-security-notifications@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqYn66z6tz6jq8J for ; Tue, 30 Jun 2026 19:56:26 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [96.47.72.132]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqYn64SXVz43RN; Tue, 30 Jun 2026 19:56:26 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782849386; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=XO9BCP2/dSiNktX9SCoQHNWnhXU0qjcZ9Nv4oVRGdg0=; b=lLgpfcWRvZtWlQa8aYKidf382RE2w/1zfO8J1rAqxfizsYcnaoni44UDUZgexLlAOw+i4C 0YNKhF5Xu8zV/gkFyFVyBHlcV5kuL31GzvFYon6NRubN2lGOb23o+1XxfhCiPoTnrhHA52 9R/OpeC7BcNWFIHYxF6wQD0IjiuqzC3SbmdZLog7HUKr9D2EzRsK72jkVAQO9J8glBJx+/ g/EvQjW01VNMjjT1KhT0fRkXfFwQqbRjU9/cV2HuFAQ5KvKK0h1qxUOj3eIgBmlZSSMdrc c8peBez/wrKouaCgnNrUtA8fYtY3lIvmLYVy3N9sDKj4K8Zwhl1Nv6fC8YrxJg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782849386; a=rsa-sha256; cv=none; b=uGfTjt0hzBZXANI7vdv3kE7skqIcNzhnCGeMQkA7/0tzv+Q02TN+opulk4ZHTw0YrrOYvS r4ZgVaRjAsS3vEPB5QScdoyjuiCito6zlpkBcx3tjr2UZwpxn3SeGKeLYT/BLxcMMozxNT VLSHtfnbi5GnVa7GpJ1vgWgUuNkZpHV9wwGpYr01fajzU8xefjNjThzUOh+AnHTvgQNjL5 6cXOI0hI6Dz7IM7NtDCLStqDxkqh+fQ+Z2bmp4iB7q4hAwv/8AtS4cVEZi04qQtS0k63gA UFPJZUorrLI6qe8XIYEW8m5Rv110R7jPhiqNvy50ExvoZLThwgafLvRCiYlo5A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782849386; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=XO9BCP2/dSiNktX9SCoQHNWnhXU0qjcZ9Nv4oVRGdg0=; b=lbRsFlSMAQ8v/QZA/xoKUcZ7Yy+3M77LDWKYHM3PKsUo1u/QE38HSUUYLIFnNE9uMFCeVd kopBvbUeD6EE0mE0vpDkiGTSGng/l+CgsxHPMt1TJKgGGtxMkRSegR1u8eX9Ri1S3EgYrA 28gUquaVrWozP1adjLcwVE4Peh8mLg/jdmE0xDOBw90J8kc3hNvVKhxlPJ8y6KINtzRuju ZiYdFhH5m6KoQcVnadeeJJI5+fgkX4Ec5TCkND1rdl3TUvZdBdVE45aiz3Fuu8CW2xzrWF +tO3gXd9v3oAFBDS/6tNzQZZ4Ya4hoUvKqxI4zg5CLHt9L81pfRjgIsEyZVGFQ== Received: by freefall.freebsd.org (Postfix, from userid 945) id 806151BD8F; Tue, 30 Jun 2026 19:56:26 +0000 (UTC) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-26:47.linux Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20260630195626.806151BD8F@freefall.freebsd.org> Date: Tue, 30 Jun 2026 19:56:26 +0000 (UTC) List-Id: Moderated Security Notifications [moderated, low volume] List-Archive: https://lists.freebsd.org/archives/freebsd-security-notifications List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security-notifications@freebsd.org Sender: owner-freebsd-security-notifications@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:47.linux Security Advisory The FreeBSD Project Topic: Kernel stack disclosure in Linux compatibility layer Category: core Module: linux(4) Announced: 2026-06-30 Credits: Adam Crosser, Praetorian Affects: FreeBSD 14.3, FreeBSD 14.4 and FreeBSD 15.0 Corrected: 2026-03-20 13:36:36 UTC (stable/15, 15.0-STABLE) 2026-06-30 17:21:34 UTC (releng/15.0, 15.0-RELEASE-p11) 2026-03-20 13:37:14 UTC (stable/14, 14.4-STABLE) 2026-06-30 17:21:07 UTC (releng/14.4, 14.4-RELEASE-p7) 2026-06-30 17:20:41 UTC (releng/14.3, 14.3-RELEASE-p16) CVE Name: CVE-2026-49424 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background The Linux ABI layer (Linuxulator) allows Linux binaries to be executed on a FreeBSD kernel. This compatibility layer is supported on the amd64, aarch64 and i386 architectures. II. Problem Description The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. III. Impact An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information. IV. Workaround No workaround is available, but systems not using the Linux binary compatibility layer are not vulnerable. The Linux compatibility layer is not included in the default GENERIC kernel. The following command can be used to test if the Linux binary compatibility layer is loaded: # kldstat -m linuxelf V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:47/linux.patch # fetch https://security.FreeBSD.org/patches/SA-26:47/linux.patch.asc # gpg --verify linux.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 9f8db9cc67fb stable/15-n282671 releng/15.0/ 008ca5def63b releng/15.0-n281080 stable/14/ a347e6e20e75 stable/14-n273828 releng/14.4/ 99d936f98589 releng/14.4-n273740 releng/14.3/ 6d0438693721 releng/14.3-n271540 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmpEElQbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrveFIQAMbywS1crIKLqntgDjOA VHkUEsq7B3MGFnx8BfEDLZ/IubBmXpUsqYjA2mGy/4dZhnIKWq280RUAK/fXpTRU NhXJtaaeRfq/rOOGLdiTozltDohiPWUHZ1ITyZICJsfTbNaFHFGvRNNnVcWTJh3T 15D6/j8tJMbRccAK+Bb3mjWBP5wkxtRvZ8wDFqmem7TYg+em742ZYBxMJyV8DJat LzsRfOk7WV5lh+h0zLl5qlsYbr8WqYwxY+l2L+qVsmtuLRTy26Fx1qSivxPDjQjg erQRy/UeudTkzQpKpVHcNmier1TW349ZyQrL+5ZB2A1+UvhBnPMztiAu8ubtxC2j cZNnK9b/tesd6fubKtSvg+xFFzsAM6/vLwLVoMFkdGCw9hA4Z/+53uGqqaSN+KqJ n6BaZ7kyQowYxAwvOWnN0h3zrmRBueB+C2zPwwOo6vDptZJNcj5omssjg3KYZ0/3 bqVbA3VEhWsY4sKjh637h0m/R92fYynjcduRYhSw3pbMXmA0SROKpdTxMgnrHEXG vViKW0cOHVRZDNZqDcI5YzfvPlXMEdAvrkWrlxvqyQOeTWei7dPLQiPKFxe/6SeQ 3qICnzzVgOkZDdjs44ued+10FacDCB6M1ixU0uPcWfoPaR79rQdNzQ8mpS1p0vbS ixppeXaxrot6sTGKW4n7V5ek =xA+Q -----END PGP SIGNATURE-----