CVE-2026-49426
Analyzed Analyzed - Analysis Complete

Incorrect Audit Record Status in FreeBSD ptrace(PT_SC_REMOTE) System Calls

Publication date: 2026-08-19

Last updated on: 2026-09-01

Assigner: FreeBSD

Description
When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed. Audit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-09-01
Generated
2026-09-08
AI Q&A
2026-08-19
EPSS Evaluated
2026-09-07
NVD
CVE-2026-49426
EUVD
EUVD-2026-62295

Affected Vendors & Products

Showing 38 associated CPEs
Vendor Product Version / Range
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 15.0
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.1
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.1
freebsd freebsd 15.1
freebsd freebsd 14.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-223 The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
CWE-224 The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the FreeBSD audit system. When a system call is executed via ptrace with PT_SC_REMOTE, the kernel incorrectly records the return value of an internal setup function as the result of the system call instead of the actual result. This causes audit logs to show successful operations even when they fail.

Detection Guidance

To detect this vulnerability, check audit logs for system calls executed via ptrace(PT_SC_REMOTE) that show incorrect success status despite actual failures. Review logs for mismatches between recorded and actual system call outcomes.

Impact Analysis

An attacker with debugging privileges could manipulate audit trails to show false successful operations. This could undermine intrusion detection systems that rely on audit logs to detect malicious activity.

Compliance Impact

This vulnerability could impact compliance by producing inaccurate audit records. Regulations like GDPR and HIPAA require reliable audit trails for accountability and security monitoring. False audit data may fail compliance audits or hinder incident investigations.

Mitigation Strategies

Apply available patches for your FreeBSD version using pkg(8), freebsd-update(8), or source code patches. Upgrade to corrected versions for stable/15, stable/14, or release branches (15.1, 15.0, 14.4, 14.3). Reboot the system after applying updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart