waitid() in FreeBSD leaks uninitialized kernel stack data

Executive Summary

This vulnerability involves the Linux waitid() function in FreeBSD's Linux compatibility layer. It fails to zero a stack-declared Linux siginfo_t struct before copying data, potentially exposing 104 bytes of uninitialized kernel stack memory containing sensitive information to unprivileged users.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking if your FreeBSD system uses the Linux compatibility layer (Linuxulator) and if it is running a vulnerable version. Commands include: sysctl compat.linux.osrelease to check Linuxulator status, uname -a to verify FreeBSD version, and pkg audit to check for vulnerable packages. Compare versions against the advisory dates (March 20, 2026, and June 30, 2026).

Useful 0 Not Useful 0

Impact Analysis

An unprivileged user could access sensitive kernel memory data, which may include passwords, encryption keys, or other confidential information. This could lead to information disclosure or potential privilege escalation if combined with other exploits.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR or HIPAA. Organizations must address it to maintain regulatory compliance and protect user privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade your FreeBSD system using pkg upgrade, freebsd-update fetch install, or apply source patches. Reboot the system after updating. If the Linuxulator is not needed, disable it via sysctl compat.linux.osrelease=disable or remove the kernel module.

Useful 0 Not Useful 0