An uninitialized region of kernel stack memory is exposed when the Linux compatibility layer’s waitid() function in FreeBSD copies a FreeBSD siginfo_t onto a stack‑allocated Linux siginfo_t without clearing the buffer first. The result is a leak of 104 bytes of kernel stack data to the caller, potentially containing sensitive information. This exposes confidential kernel data to unprivileged users through a local system call and is an example of information exposure through an uninitialized object.

FreeBSD operating systems that provide the Linux compatibility layer are affected. The advisory does not list specific release versions, so any FreeBSD release that still ships the unpatched waitid() implementation carries this risk. The exposure is limited to machines where the kernel’s compatibility layer is active and the waitid() syscall can be invoked by user processes.

With a CVSS score of 5.5, the vulnerability is considered moderate; the EPSS score is below one percent and the vulnerability is not listed in the CISA KEV catalog, indicating a very low likelihood of public exploitation. Nevertheless, the attack vector is local and simple: an attacker only needs to run an unprivileged process that calls waitid() to trigger the disclosure. The impact remains confined to confidentiality leakage of kernel stack contents, with no direct privilege escalation or code execution possible. The weakness corresponds to the information exposure weakness classified as CWE-908.