CVE-2026-58092

CVE-2026-58092 affects the mac_do(4) MAC policy module in FreeBSD 15.0 and later . After a kernel credential structure change, the function group_is_primary() was not properly updated, causing it to incorrectly read the primary group ID from the first element of the supplementary group array duri...

CVE-2026-58092 Unauthorized credential switching

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

CVE-2026-58092 Unauthorized credential switching

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

EUVD-2026-66237

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

FreeBSD : FreeBSD -- Multiple vulnerabilities in ppp(8) (204af099-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 204af099-a0ff-11f1-ae1f-bc241121aa0a advisory. ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator...

FreeBSD : OpenSSL -- Multiple vulnerabilities (9008d14d-a0af-11f1-8144-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9008d14d-a0af-11f1-8144-8447094a420f advisory. The OpenSSL poject reports: Tenable has extracted the preceding description block directly fro...

PT-2026-81930

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

FreeBSD : FreeBSD -- Unauthorized credential switching (55fbe7b1-a0fe-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 55fbe7b1-a0fe-11f1-ae1f-bc241121aa0a advisory. In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primar...

FreeBSD-SA-26:58.sound

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:58.sound Security Advisory The FreeBSD Project Topic: Kernel use-after-free via the SNDCTLDSPSYNCSTART ioctl Category: core Module: sound Announced:...

FreeBSD-SA-26:61.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:61.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2026-08-25 Credits:...

FreeBSD-SA-26:57.unix

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:57.unix Security Advisory The FreeBSD Project Topic: Use-after-free in unix SOCKSTREAM message handling Category: core Module: unix Announced: 2026-08-25...

FreeBSD-SA-26:62.tty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:62.tty Security Advisory The FreeBSD Project Topic: Kernel use-after-free via tty ioctls Category: core Module: tty Announced: 2026-08-25 Credits: tsune of...

FreeBSD -- Use-after-free in unix SOCK_STREAM message handling

Problem Description: The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. Impact: An unprivileged loca...

FreeBSD -- Unauthorized credential switching

Problem Description: In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This...

FreeBSD -- Multiple vulnerabilities in ppp(8)

Problem Description: ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator options. mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result...

FreeBSD -- hwpmc fails to detach PMCs during exec credential transitions

Problem Description: When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. Impact: An unprivileged local user who has attached PMCs to a process can...

FreeBSD -- TOCTOU race in POSIX shared memory large page configuration

Problem Description: The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been...

FreeBSD-SA-26:63.posixshm

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:63.posixshm Security Advisory The FreeBSD Project Topic: TOCTOU race in POSIX shared memory large page configuration Category: core Module: posixshm...

FreeBSD-SA-26:56.hwpmc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:56.hwpmc Security Advisory The FreeBSD Project Topic: hwpmc fails to detach PMCs during exec credential transitions Category: core Module: hwpmc Announced:...

FreeBSD-SA-26:60.ppp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:60.ppp Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in ppp8 Category: core Module: ppp Announced: 2026-08-25 Credits: Robert Morris...