The Linux waitid() system call implementation translates a FreeBSD siginfo_t struct into a Linux siginfo_t struct allocated on the stack. However, the stack memory for the Linux siginfo_t is not zero-initialized before use. This can lead to leakage of uninitialized kernel stack data to unprivileged users, exposing potentially sensitive information. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource). No patch or remediation details are provided in the available data.

An unprivileged user can access 104 bytes of uninitialized kernel stack memory through the waitid() system call. This exposure may lead to information disclosure of sensitive kernel data, which could aid attackers in further exploitation or privilege escalation attempts. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the waitid() system call or monitoring for unusual usage patterns if feasible.