PT-2026-70013

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description Calling the msyncMS INVALIDATE function on a mapping of an unmanaged device object causes physical pages in the mapping range to be marked invalid while remaining in the pager's page list. A...

FreeBSD Security Advisory - FreeBSD-SA-26:42.unlinkat

FreeBSD Security Advisory - The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted...

FreeBSD Security Advisory - FreeBSD-SA-26:40.zfs

FreeBSD Security Advisory - The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. The ZFSIOCRECVNEW ioctl, in the heal receive path,...

FreeBSD Security Advisory - FreeBSD-SA-26:37.vm

FreeBSD Security Advisory - When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's lis...

FreeBSD Security Advisory - FreeBSD-SA-26:38.jail

FreeBSD Security Advisory - When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time...

PT-2026-70015

Name of the Vulnerable Software and Affected Versions FreeBSD kernel affected versions not specified Description The kernel functions implementing unlinkat2 and funlinkat2 fail to pass the AT RESOLVE BENEATH flag to the underlying path lookup process. Although the flag is validated, it is silentl...

PT-2026-71933

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description Insufficient input validation in the implementation of largepage shared memory objects allows an unprivileged local user to access freed kernel memory. This occurs because certain system call...

FreeBSD Security Advisory - FreeBSD-SA-26:43.tcp

FreeBSD Security Advisory - The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection...

FreeBSD Security Advisory - FreeBSD-SA-26:44.posixshm

FreeBSD Security Advisory - Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. Separately, certain...

FreeBSD Security Advisory - FreeBSD-SA-26:48.compat32

FreeBSD Security Advisory - The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct...

FreeBSD Security Advisory - FreeBSD-SA-26:45.audit

FreeBSD Security Advisory - When auditing a system call executed via ptracePTSCREMOTE, the kernel passed the return value of an internal setup function to AUDITSYSCALLEXIT rather than the actual result of the executed system call. As a result, committed audit records for system calls which return...

FreeBSD Security Advisory - FreeBSD-SA-26:41.libalias

FreeBSD Security Advisory - The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet...

FreeBSD Security Advisory - FreeBSD-SA-26:39.execve

FreeBSD Security Advisory - During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging...

PT-2026-55921

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description The RTSP handler in the libalias library rewrites outgoing packets into a fixed-length stack buffer without verifying if the rewritten data fits within the buffer or if the result fits back...

FreeBSD Security Advisory - FreeBSD-SA-26:46.ktls

FreeBSD Security Advisory - When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec...

FreeBSD -- Multiple vulnerabilities in iconv(3)

Problem Description: Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. CVE-2026-58081 The ISO-2022 encoding module used a stack buffer sized to MBLENMAX 6 bytes for intermediate...

FreeBSD -- Kernel stack disclosure in Linux compatibility layer

Problem Description: The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. Impact: An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

FreeBSD -- Buffer overflow in libalias RTSP handler

Problem Description: The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. Impact: A host sending crafted RTSP traffic from inside a NAT gateway...

FreeBSD -- Jail reference count underflow

Problem Description: When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. Impact: An...

FreeBSD -- Multiple vulnerabilities in OpenZFS

Problem Description: The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly...