Riskcovery

CVE-2026-49426

Incorrect audit records for ptrace(2) syscall requests

State
Published
Severity
3.3 Low
Published
Aug 19, 2026
Updated
Aug 26, 2026
Reserved
May 29, 2026

Read the record on cve.org

Description

When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed.

Audit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS).

Scores

CVSSScoreVectorSource
3.13.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCISA-ADP

Weaknesses

  • CWE-223 Omission of Security-relevant Information
  • CWE-224 Obscured Security-relevant Information by Alternate Name

Affected Products

ProductVersions
FreeBSDFreeBSD
  • 15.1-RELEASE to before p1Affected
  • 15.0-RELEASE to before p11Affected
  • 14.4-RELEASE to before p7Affected
  • 14.3-RELEASE to before p16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.