FreeBSD-kernel -- Kernel stack disclosure in 32-bit compatibility support

Problem Description: The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. Impact: An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...

FreeBSD -- Local privilege escalation via execve(2) TOCTOU race

Problem Description: During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging...

FreeBSD -- unlinkat(2) ignores AT_RESOLVE_BENEATH flag

Problem Description: The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. Impact: A process that uses...

FreeBSD -- Remote DOS via uninitialized memory access in KTLS receive

Problem Description: When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. T...

FreeBSD -- Multiple vulnerabilities in OpenZFS

Problem Description: The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly...

PT-2026-55921

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description The RTSP handler in the libalias library rewrites outgoing packets into a fixed-length stack buffer without verifying if the rewritten data fits within the buffer or if the result fits back...

FreeBSD-SA-26:46.ktls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:46.ktls Security Advisory The FreeBSD Project Topic: Remote DOS via uninitialized memory access in KTLS receive Category: core Module: ktls Announced:...

FreeBSD-SA-26:45.audit

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:45.audit Security Advisory The FreeBSD Project Topic: Incorrect audit records for ptrace2 syscall requests Category: core Module: audit Announced: 2026-06-30...

FreeBSD-SA-26:43.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:43.tcp Security Advisory The FreeBSD Project Topic: Use-after-free in TCP RACK stack option handler Category: core Module: tcp Announced: 2026-06-30 Credits:...

FreeBSD -- Use-after-free in TCP RACK stack option handler

Problem Description: The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control...

FreeBSD -- Buffer overflow in libalias RTSP handler

Problem Description: The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. Impact: A host sending crafted RTSP traffic from inside a NAT gateway...

FreeBSD -- Jail reference count underflow

Problem Description: When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. Impact: An...

FreeBSD -- Kernel stack disclosure in Linux compatibility layer

Problem Description: The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. Impact: An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

FreeBSD : PowerDNS -- vulnerabilities (a8614190-73b4-11f1-910d-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a8614190-73b4-11f1-910d-3c7c3fba4204 advisory. PowerDNS Team reports: Thanks to people below for reporting these vulnerabilities: Thanks to...

FreeBSD : powerdns-recursor -- vulnerabilities (62c4ed54-73aa-11f1-910d-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 62c4ed54-73aa-11f1-910d-3c7c3fba4204 advisory. PowerDNS Team reports: Thanks to people below for reporting these vulnerabilities. Tenable has...

FreeBSD : gitea -- multiple vulnerabilities (f00e2de8-7d30-48d2-a43d-68206347dea6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f00e2de8-7d30-48d2-a43d-68206347dea6 advisory. The Gitea team reports: Tenable has extracted the preceding description block directly from th...

FreeBSD : DNSdist -- vulnerabilities (6c0e17cf-73a0-11f1-910d-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6c0e17cf-73a0-11f1-910d-3c7c3fba4204 advisory. The DNSdist team reports: Thanks to people below for reporting these vulnerabilities. Tenable...

FreeBSD : gstreamer1 -- multiple vulnerabilities (4e82a0e6-6801-42c6-8fb6-91b6b275a9e1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4e82a0e6-6801-42c6-8fb6-91b6b275a9e1 advisory. The GStreamer project reports: Multiple security issues were identified and fixed in the...

FreeBSD : Multiple vulnerability found in Expat (d06b1fa2-731f-11f1-a0d2-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d06b1fa2-731f-11f1-a0d2-589cfc10a551 advisory. Expat 2.8.2 was released yesterday. The key motivation for cutting a release and doing so now...

FreeBSD : ffmpeg -- Out-of-bounds write (ba8d239f-709f-11f1-a30e-28d2443e6cfa)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ba8d239f-709f-11f1-a30e-28d2443e6cfa advisory. https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159 reports: An out-of-bounds write vulnerability in...