FreeBSD audit ptrace CVE-2026-49426 Advisory: Audit Record Forgery via AUDIT_SYSCALL_EXIT

Vulnerability Overview Vulnerability Name: CVE-2026-49426 Vulnerability Description: When executing arbitrary system calls via the system call, the kernel returns the result of an internally set rather than the result of the actual system call execution. This causes submitted audit records to fail to reflect the true result of the system call; specifically, failures are reported as successes. Impact: Audit records may display incorrect error statuses. Attackers can exploit this to generate misleading audit trails, thereby weakening audit-based Intrusion Detection Systems (IDS). Affected Systems Affected Systems: All supported versions of FreeBSD. Affected Module: Affected Branches: - - - - - - Remediation 1. Upgrade the System: - Upgrade the system to a version released after the correction date in FreeBSD stable or release branches ( ), and reboot the system. - For FreeBSD systems installed from base system packages (amd64 or arm64 platforms, FreeBSD 15.0-RELEASE or later), use the utility to update: - For FreeBSD systems installed from binary distribution sets (amd64 or arm64 platforms, not installed via base system packages), use the utility to update: 2. Apply the Patch: - Download and verify the patch from the specified location: - Apply the patch: - Rebuild the kernel and reboot the system: Verification Details To confirm the issue is fixed, you can view the files modified by specific commits using the following command: Alternatively, visit the following URL, replacing with the corresponding hash value: Count the number of commits in the working tree (to compare with the running count in the table): References CVE Details: https://www.cve.org/CVERecord?id=CVE-2026-49426 Latest Advisory: https://security.FreeBSD.org/advisories/FreeBSD-SA-26:45.audit.asc --- Note: No Proof of Concept (POC) code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

FreeBSD audit ptrace CVE-2026-49426 Advisory: Audit Record Forgery via AUDIT_SYSCALL_EXIT