Technical impact
The compat32 kevent handler in the FreeBSD kernel converts a 64‑bit kevent structure to a 32‑bit structure on a stack frame that is not zeroed beforehand. Because the stack already contains leftover data from prior kernel operations, an unprivileged local user who invokes kevent() can read a small portion of that kernel memory. This results in a confidentiality disclosure of kernel stack data, which may contain sensitive information. The weakness corresponds to CWE-908.
Affected Systems
All FreeBSD releases that include the 32‑bit compatibility layer and the compat32 kevent implementation are potentially vulnerable. The advisory (FreeBSD‑SA‑26:48.compat32) does not list specific version ranges, so administrators should verify whether their installed FreeBSD version contains the compat32 kevent code and consult the advisory for precise affected releases.
Risk and Exploitability
The EPSS score is below 1 %, indicating a low current probability of exploitation, and the vulnerability is not present in the CISA KEV catalog. An attacker only needs local unprivileged access and the ability to call kevent() under the 32‑bit compatibility environment; no elevated privileges are required. The impact is limited to viewing a small amount of kernel stack memory, but the data revealed could have confidentiality implications. The CVSS score of 5.5 reflects a moderate severity for this type of privilege‑leveled information disclosure.
