CVE-2026-49426

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49426", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-05-29T20:24:28.616Z", "datePublished": "2026-08-19T06:04:36.581Z", "dateUpdated": "2026-08-26T17:44:51.652Z"}, "containers": {"cna": {"datePublic": "2026-06-30T20:00:00.000Z", "title": "Incorrect audit records for ptrace(2) syscall requests", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:45.audit.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["audit"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "versionType": "release", "version": "15.1-RELEASE", "lessThan": "p1"}, {"status": "affected", "versionType": "release", "version": "15.0-RELEASE", "lessThan": "p11"}, {"status": "affected", "versionType": "release", "version": "14.4-RELEASE", "lessThan": "p7"}, {"status": "affected", "versionType": "release", "version": "14.3-RELEASE", "lessThan": "p16"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kyle Evans"}], "descriptions": [{"lang": "en", "value": "When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed.\n\nAudit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS)."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-223", "description": "CWE-223: Omission of Security-relevant Information", "lang": "en", "type": "CWE"}, {"cweId": "CWE-224", "description": "CWE-224: Obscured Security-relevant Information by Alternate Name", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-08-19T06:04:36.581Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T17:44:49.000845Z", "id": "CVE-2026-49426", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T17:44:51.652Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-49426", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T17:44:49.000845Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T17:44:46.333Z"}}], "cna": {"title": "Incorrect audit records for ptrace(2) syscall requests", "credits": [{"lang": "en", "type": "finder", "value": "Kyle Evans"}], "affected": [{"vendor": "FreeBSD", "modules": ["audit"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.1-RELEASE", "lessThan": "p1", "versionType": "release"}, {"status": "affected", "version": "15.0-RELEASE", "lessThan": "p11", "versionType": "release"}, {"status": "affected", "version": "14.4-RELEASE", "lessThan": "p7", "versionType": "release"}, {"status": "affected", "version": "14.3-RELEASE", "lessThan": "p16", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2026-06-30T20:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:45.audit.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed.\n\nAudit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-223", "description": "CWE-223: Omission of Security-relevant Information"}, {"lang": "en", "type": "CWE", "cweId": "CWE-224", "description": "CWE-224: Obscured Security-relevant Information by Alternate Name"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-08-19T06:04:36.581Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49426", "state": "PUBLISHED", "dateUpdated": "2026-08-26T17:44:51.652Z", "dateReserved": "2026-05-29T20:24:28.616Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2026-08-19T06:04:36.581Z", "assignerShortName": "freebsd"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["audit"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p1", "status": "affected", "version": "15.1-RELEASE", "versionType": "release"}, {"lessThan": "p11", "status": "affected", "version": "15.0-RELEASE", "versionType": "release"}, {"lessThan": "p7", "status": "affected", "version": "14.4-RELEASE", "versionType": "release"}, {"lessThan": "p16", "status": "affected", "version": "14.3-RELEASE", "versionType": "release"}]}], "source": "secteam@freebsd.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*", "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*", "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*", "matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*", "matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:*", "matchCriteriaId": "9F83F91B-587A-433C-99DB-0D63E267FF16", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:*", "matchCriteriaId": "44B9C2FC-756E-459F-8E68-C2C2B8C258AC", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p14:*:*:*:*:*:*", "matchCriteriaId": "A11526CF-505E-47DF-8388-65CB216D2022", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p15:*:*:*:*:*:*", "matchCriteriaId": "632175D0-5327-4458-8968-8FA39D00F236", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*", "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*", "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*", "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*", "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*", "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*", "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*", "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*", "matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*", "matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*", "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*", "matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*", "matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*", "matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*", "matchCriteriaId": "CBE94635-5277-4050-8098-F062091F6596", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*", "matchCriteriaId": "A66308E4-DA6E-48DB-86E5-A503EE110EAD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*", "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*", "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*", "matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*", "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*", "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*", "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*", "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*", "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*", "matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*", "matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*", "matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*", "matchCriteriaId": "BD327D43-A2DC-49B5-A578-D2116E1E12F3", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "BF16D01F-95EC-4FE3-B32D-135CB82E8391", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:*", "matchCriteriaId": "75973F7C-645A-438C-A03B-C77AAAD20C15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed.\n\nAudit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS)."}, {"lang": "es", "value": "Al auditar una llamada al sistema ejecutada a trav\u00e9s de ptrace(PT_SC_REMOTE), el kernel pas\u00f3 el valor de retorno de una funci\u00f3n de configuraci\u00f3n interna a AUDIT_SYSCALL_EXIT() en lugar del resultado real de la llamada al sistema ejecutada. Como resultado, los registros de auditor\u00eda confirmados para las llamadas al sistema que devolvieron un error no reflejan el verdadero resultado de la operaci\u00f3n. Es decir, indican que la operaci\u00f3n tuvo \u00e9xito cuando en realidad fall\u00f3.\n\nLos registros de auditor\u00eda para las llamadas al sistema ejecutadas a trav\u00e9s de ptrace(PT_SC_REMOTE) pueden mostrar un estado de error incorrecto. Un atacante con la capacidad de depurar un proceso podr\u00eda usar esto para producir rastros de auditor\u00eda enga\u00f1osos, socavando potencialmente los Sistemas de Detecci\u00f3n de Intrusiones (IDS) basados en auditor\u00edas."}], "id": "CVE-2026-49426", "lastModified": "2026-11-09T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49426", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T17:44:49.000845Z", "version": "2.0.3"}}]}, "published": "2026-08-19T06:17:41.720", "references": [{"source": "secteam@freebsd.org", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:45.audit.asc"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-223"}, {"lang": "en", "value": "CWE-224"}], "source": "secteam@freebsd.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.1-RELEASE,p1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.0-RELEASE,p11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[14.4-RELEASE,p7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[14.3-RELEASE,p16)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeBSD", "source": "cna", "vendor": "FreeBSD"}, "product": "freebsd", "vendor": "freebsd"}], "created": "2026-08-19T12:30:04.706066+00:00", "updated": "2026-08-26T20:15:03.901008+00:00", "vendors": ["freebsd", "freebsd$PRODUCT$freebsd"]}