EUVD-2026-66237

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

CVE-2026-58092

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

CVE-2026-58092: Authentication Bypass Using an Alternate Path or Channel

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

FreeBSD : FreeBSD -- Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl (226751fb-a0fe-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 226751fb-a0fe-11f1-ae1f-bc241121aa0a advisory. The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking ...

FreeBSD : OpenSSL -- Multiple vulnerabilities (9008d14d-a0af-11f1-8144-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9008d14d-a0af-11f1-8144-8447094a420f advisory. The OpenSSL poject reports: Tenable has extracted the preceding description block directly fro...

FreeBSD : FreeBSD -- Multiple vulnerabilities in ppp(8) (204af099-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 204af099-a0ff-11f1-ae1f-bc241121aa0a advisory. ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator...

FreeBSD : FreeBSD -- TOCTOU race in POSIX shared memory large page configuration (ef63188f-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ef63188f-a0ff-11f1-ae1f-bc241121aa0a advisory. The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This ...

PT-2026-81930

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

FreeBSD : FreeBSD -- hwpmc fails to detach PMCs during exec credential transitions (9c2801aa-a0fd-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9c2801aa-a0fd-11f1-ae1f-bc241121aa0a advisory. When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs own...

FreeBSD : FreeBSD -- Use-after-free in unix SOCK_STREAM message handling (e99e4b19-a0fd-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e99e4b19-a0fd-11f1-ae1f-bc241121aa0a advisory. The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages...

FreeBSD : FreeBSD -- Unauthorized credential switching (55fbe7b1-a0fe-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 55fbe7b1-a0fe-11f1-ae1f-bc241121aa0a advisory. In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primar...

FreeBSD : FreeBSD -- Kernel use-after-free via tty ioctls (a34b5154-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a34b5154-a0ff-11f1-ae1f-bc241121aa0a advisory. The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After...

FreeBSD Security Advisory - FreeBSD-SA-26:59.mac_do

FreeBSD Security Advisory - In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated fiel...

FreeBSD Security Advisory - FreeBSD-SA-26:57.unix

FreeBSD Security Advisory - The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer...

FreeBSD Security Advisory - FreeBSD-SA-26:63.posixshm

FreeBSD Security Advisory - The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been...

FreeBSD : MariaDB -- Multiple vulnerabilities (f68670ea-a05d-11f1-8144-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f68670ea-a05d-11f1-8144-8447094a420f advisory. The MariaDB project reports: Details in links Tenable has extracted the preceding description...

FreeBSD Security Advisory - FreeBSD-SA-26:60.ppp

FreeBSD Security Advisory - ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator options. mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global...

FreeBSD Security Advisory - FreeBSD-SA-26:61.openssl

FreeBSD Security Advisory - Multiple issues have been reported as part of this advisory with different issues affecting different OpenSSL versions and therefore different FreeBSD versions...

FreeBSD Security Advisory - FreeBSD-SA-26:58.sound

FreeBSD Security Advisory - The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementatio...

FreeBSD Security Advisory - FreeBSD-SA-26:62.tty

FreeBSD Security Advisory - The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling...