CVE-2026-49426
Full vulnerability record from the local CVENow database.
Description
When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed. Audit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS).
Severity
LOW
CVSS score
3.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-19 06:17:41.720000
Last modified
2026-11-09 20:10:00.200000
View original CVE JSON
{
"id": "CVE-2026-49426",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T06:17:41.720",
"lastModified": "2026-11-09T20:10:00.200",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed.\n\nAudit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS)."
},
{
"lang": "es",
"value": "Al auditar una llamada al sistema ejecutada a través de ptrace(PT_SC_REMOTE), el kernel pasó el valor de retorno de una función de configuración interna a AUDIT_SYSCALL_EXIT() en lugar del resultado real de la llamada al sistema ejecutada. Como resultado, los registros de auditoría confirmados para las llamadas al sistema que devolvieron un error no reflejan el verdadero resultado de la operación. Es decir, indican que la operación tuvo éxito cuando en realidad falló.\n\nLos registros de auditoría para las llamadas al sistema ejecutadas a través de ptrace(PT_SC_REMOTE) pueden mostrar un estado de error incorrecto. Un atacante con la capacidad de depurar un proceso podría usar esto para producir rastros de auditoría engañosos, socavando potencialmente los Sistemas de Detección de Intrusiones (IDS) basados en auditorías."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "FreeBSD",
"product": "FreeBSD",
"defaultStatus": "unknown",
"modules": [
"audit"
],
"versions": [
{
"version": "15.1-RELEASE",
"lessThan": "p1",
"versionType": "release",
"status": "affected"
},
{
"version": "15.0-RELEASE",
"lessThan": "p11",
"versionType": "release",
"status": "affected"
},
{
"version": "14.4-RELEASE",
"lessThan": "p7",
"versionType": "release",
"status": "affected"
},
{
"version": "14.3-RELEASE",
"lessThan": "p16",
"versionType": "release",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 3.3,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-26T17:44:49.000845Z",
"id": "CVE-2026-49426",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-223"
},
{
"lang": "en",
"value": "CWE-224"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*",
"matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*",
"matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*",
"matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*",
"matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:*",
"matchCriteriaId": "9F83F91B-587A-433C-99DB-0D63E267FF16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:*",
"matchCriteriaId": "44B9C2FC-756E-459F-8E68-C2C2B8C258AC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p14:*:*:*:*:*:*",
"matchCriteriaId": "A11526CF-505E-47DF-8388-65CB216D2022"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p15:*:*:*:*:*:*",
"matchCriteriaId": "632175D0-5327-4458-8968-8FA39D00F236"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*",
"matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*",
"matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*",
"matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*",
"matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*",
"matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*",
"matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*",
"matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*",
"matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*",
"matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "CBE94635-5277-4050-8098-F062091F6596"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "A66308E4-DA6E-48DB-86E5-A503EE110EAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*",
"matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
"matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*",
"matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*",
"matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*",
"matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*",
"matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*",
"matchCriteriaId": "BD327D43-A2DC-49B5-A578-D2116E1E12F3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "BF16D01F-95EC-4FE3-B32D-135CB82E8391"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:*",
"matchCriteriaId": "75973F7C-645A-438C-A03B-C77AAAD20C15"
}
]
}
]
}
],
"references": [
{
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:45.audit.asc",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}