PT-2026-71932

Name of the Vulnerable Software and Affected Versions FreeBSD kernel affected versions not specified Description When auditing a system call executed via ptracePT SC REMOTE, the kernel passes the return value of an internal setup function to AUDIT SYSCALL EXIT instead of the actual result of the...

PT-2026-55922

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description A use-after-free issue exists in the tcp rack.ko kernel module. The RACK setsockopt2 handler releases the connection lock to copy option data from userspace and subsequently reacquires it...

PT-2026-71930

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description An issue exists in the implementation of largepage shared memory objects where pages were not explicitly wired. When the sendfile2 function transmits such an object using the SF NOCACHE flag,...

FreeBSD-SA-26:48.compat32

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:48.compat32 Security Advisory The FreeBSD Project Topic: Kernel stack disclosure in 32-bit compatibility support Category: core Module: kernel compat32...

FreeBSD-SA-26:47.linux

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:47.linux Security Advisory The FreeBSD Project Topic: Kernel stack disclosure in Linux compatibility layer Category: core Module: linux4 Announced: 2026-06-3...

FreeBSD-SA-26:45.audit

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:45.audit Security Advisory The FreeBSD Project Topic: Incorrect audit records for ptrace2 syscall requests Category: core Module: audit Announced: 2026-06-30...

FreeBSD-SA-26:43.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:43.tcp Security Advisory The FreeBSD Project Topic: Use-after-free in TCP RACK stack option handler Category: core Module: tcp Announced: 2026-06-30 Credits:...

FreeBSD-SA-26:41.libalias

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:41.libalias Security Advisory The FreeBSD Project Topic: Buffer overflow in libalias RTSP handler Category: core Module: libalias Announced: 2026-06-30...

FreeBSD-SA-26:40.zfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:40.zfs Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenZFS Category: contrib Module: openzfs Announced: 2026-06-30 Credits:...

FreeBSD-SA-26:46.ktls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:46.ktls Security Advisory The FreeBSD Project Topic: Remote DOS via uninitialized memory access in KTLS receive Category: core Module: ktls Announced:...

FreeBSD-SA-26:49.iconv

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:49.iconv Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in iconv3 Category: core Module: iconv Announced: 2026-06-30 Credits: Nick...

FreeBSD-SA-26:44.posixshm

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:44.posixshm Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in POSIX largepage objects Category: core Module: posixshm Announced:...

FreeBSD-SA-26:37.vm

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:37.vm Security Advisory The FreeBSD Project Topic: Use-after-free in device pager page list Category: core Module: vm Announced: 2026-06-30 Credits: slidybat...

FreeBSD : chromium -- security fixes (5181294e-7471-11f1-8de5-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5181294e-7471-11f1-8de5-a8a1599412c6 advisory. Chrome Releases reports: This update includes 3 security fixes: Tenable has extracted the...

FreeBSD : NSD -- vulnerabilities (bebbc065-73d2-11f1-910d-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bebbc065-73d2-11f1-910d-3c7c3fba4204 advisory. NLnet Labs reports: CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of u...

FreeBSD -- Local privilege escalation via execve(2) TOCTOU race

Problem Description: During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging...

FreeBSD -- Use-after-free in device pager page list

Problem Description: When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This...

FreeBSD -- Use-after-free in TCP RACK stack option handler

Problem Description: The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control...

FreeBSD -- Buffer overflow in libalias RTSP handler

Problem Description: The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. Impact: A host sending crafted RTSP traffic from inside a NAT gateway...

FreeBSD-kernel -- Kernel stack disclosure in 32-bit compatibility support

Problem Description: The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. Impact: An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...