CVE-2026-49426

When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it in fact failed. Audit records for system calls executed via ptrace(PT_SC_REMOTE) may show an incorrect error status. An attacker with the ability to debug a process could use this to produce misleading audit trails, potentially undermining audit-based Intrusion Detection Systems (IDS).

• CWE-223
• CWE-224

• https://security.freebsd.org/advisories/FreeBSD-SA-26:45.audit.ascVendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49420The RTSP handler in libalias rewrote outgoing packets into a…8.8
• CVE-2026-49421The kernel function that implements unlinkat(2) and funlinka…7.1
• CVE-2026-49422The RACK setsockopt(2) handler drops the connection lock in …8.4
• CVE-2026-49423When building the iovec array for a received TLS 1.2 CBC rec…3.3
• CVE-2026-49424The Linux waitid() implementation translates a FreeBSD sigin…5.5
• CVE-2026-49425The compat32 kevent() handler translates a 64-bit kevent str…5.5
• CVE-2026-49427Pages belonging to largepage shared memory objects were not …8.8
• CVE-2026-49428Certain system calls, such open(2) with the O_TRUNC flag set…8.4
• CVE-2026-49429The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), …7.8
• CVE-2026-49430The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, simila…7.8
• CVE-2026-49431The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly …3.3
• CVE-2026-49432Improper Input Validation vulnerability in Apache ActiveMQ, …7.5