https://vulnogram.org/ Most recent CVEs assigned by FreeBSD (freebsd). https://vulnogram.org/seaview/icons/freebsd.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-101311 https://vulnogram.org/CVE-2026-101311 The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation… High Thu, 15 Oct 2026 07:18:18 GMT https://vulnogram.org/CVE-2026-101310 https://vulnogram.org/CVE-2026-101310 The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modificati… High Thu, 15 Oct 2026 07:18:11 GMT https://vulnogram.org/CVE-2026-101309 https://vulnogram.org/CVE-2026-101309 The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modificati… High Thu, 15 Oct 2026 07:17:50 GMT https://vulnogram.org/CVE-2026-101308 https://vulnogram.org/CVE-2026-101308 When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after whi… Medium Thu, 15 Oct 2026 07:08:52 GMT https://vulnogram.org/CVE-2026-101307 https://vulnogram.org/CVE-2026-101307 When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersi… High Network Exploitable Thu, 15 Oct 2026 07:05:02 GMT https://vulnogram.org/CVE-2026-101303 https://vulnogram.org/CVE-2026-101303 The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the ho… High Network Exploitable Thu, 15 Oct 2026 06:58:55 GMT https://vulnogram.org/CVE-2026-101302 https://vulnogram.org/CVE-2026-101302 TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leadi… Medium Thu, 15 Oct 2026 06:53:12 GMT https://vulnogram.org/CVE-2026-101306 https://vulnogram.org/CVE-2026-101306 SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a dir… Critical Network Exploitable Thu, 15 Oct 2026 06:46:25 GMT https://vulnogram.org/CVE-2026-101305 https://vulnogram.org/CVE-2026-101305 renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem t… High Thu, 15 Oct 2026 06:46:16 GMT https://vulnogram.org/CVE-2026-101304 https://vulnogram.org/CVE-2026-101304 When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file d… High Thu, 15 Oct 2026 06:46:03 GMT https://vulnogram.org/CVE-2026-58100 https://vulnogram.org/CVE-2026-58100 kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the… High Thu, 15 Oct 2026 06:31:27 GMT https://vulnogram.org/CVE-2026-58099 https://vulnogram.org/CVE-2026-58099 When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a mark… High Thu, 15 Oct 2026 06:31:18 GMT https://vulnogram.org/CVE-2026-58098 https://vulnogram.org/CVE-2026-58098 When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asle… High Thu, 15 Oct 2026 06:15:44 GMT https://vulnogram.org/CVE-2026-58094 https://vulnogram.org/CVE-2026-58094 The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page s… High Wed, 26 Aug 2026 05:39:42 GMT https://vulnogram.org/CVE-2026-58093 https://vulnogram.org/CVE-2026-58093 The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destr… High Wed, 26 Aug 2026 05:33:30 GMT https://vulnogram.org/CVE-2026-58097 https://vulnogram.org/CVE-2026-58097 mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitra… High Wed, 26 Aug 2026 05:28:17 GMT https://vulnogram.org/CVE-2026-58096 https://vulnogram.org/CVE-2026-58096 LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-5… High Wed, 26 Aug 2026 05:28:09 GMT https://vulnogram.org/CVE-2026-58095 https://vulnogram.org/CVE-2026-58095 mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitra… High Wed, 26 Aug 2026 05:28:00 GMT https://vulnogram.org/CVE-2026-58092 https://vulnogram.org/CVE-2026-58092 In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored… High Wed, 26 Aug 2026 04:46:17 GMT https://vulnogram.org/CVE-2026-58091 https://vulnogram.org/CVE-2026-58091 The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, bu… High Wed, 26 Aug 2026 04:38:19 GMT https://vulnogram.org/CVE-2026-58090 https://vulnogram.org/CVE-2026-58090 The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. A… High Wed, 26 Aug 2026 04:35:10 GMT https://vulnogram.org/CVE-2026-58089 https://vulnogram.org/CVE-2026-58089 When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached… High Wed, 26 Aug 2026 04:30:06 GMT https://vulnogram.org/CVE-2026-58088 https://vulnogram.org/CVE-2026-58088 The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the… High Wed, 19 Aug 2026 07:52:13 GMT https://vulnogram.org/CVE-2026-58087 https://vulnogram.org/CVE-2026-58087 The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that th… High Wed, 19 Aug 2026 07:47:50 GMT https://vulnogram.org/CVE-2026-58086 https://vulnogram.org/CVE-2026-58086 As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to de… High Wed, 19 Aug 2026 07:42:10 GMT https://vulnogram.org/CVE-2026-58085 https://vulnogram.org/CVE-2026-58085 After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. A remote attac… High Network Exploitable Wed, 19 Aug 2026 07:38:50 GMT https://vulnogram.org/CVE-2026-58084 https://vulnogram.org/CVE-2026-58084 To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked,… Medium Wed, 19 Aug 2026 07:31:42 GMT https://vulnogram.org/CVE-2026-58083 https://vulnogram.org/CVE-2026-58083 While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second… High Wed, 19 Aug 2026 07:28:28 GMT https://vulnogram.org/CVE-2026-58082 https://vulnogram.org/CVE-2026-58082 The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to… Critical Network Exploitable Wed, 19 Aug 2026 07:20:37 GMT https://vulnogram.org/CVE-2026-58081 https://vulnogram.org/CVE-2026-58081 Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the… Critical Network Exploitable Wed, 19 Aug 2026 07:20:26 GMT https://vulnogram.org/CVE-2026-49425 https://vulnogram.org/CVE-2026-49425 The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensit… Medium Wed, 19 Aug 2026 07:11:21 GMT https://vulnogram.org/CVE-2026-49424 https://vulnogram.org/CVE-2026-49424 The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain se… Medium Wed, 19 Aug 2026 07:08:35 GMT https://vulnogram.org/CVE-2026-49423 https://vulnogram.org/CVE-2026-49423 When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitializ… Low Wed, 19 Aug 2026 07:01:49 GMT https://vulnogram.org/CVE-2026-49426 https://vulnogram.org/CVE-2026-49426 When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records fo… Low Wed, 19 Aug 2026 06:04:36 GMT https://vulnogram.org/CVE-2026-49428 https://vulnogram.org/CVE-2026-49428 Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged l… High Wed, 19 Aug 2026 05:57:04 GMT https://vulnogram.org/CVE-2026-49427 https://vulnogram.org/CVE-2026-49427 Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them.… High Wed, 19 Aug 2026 05:56:53 GMT https://vulnogram.org/CVE-2026-49422 https://vulnogram.org/CVE-2026-49422 The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack'… High Wed, 19 Aug 2026 05:28:32 GMT https://vulnogram.org/CVE-2026-49421 https://vulnogram.org/CVE-2026-49421 The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A proce… High Wed, 19 Aug 2026 05:25:43 GMT https://vulnogram.org/CVE-2026-49420 https://vulnogram.org/CVE-2026-49420 The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from insi… High Wed, 19 Aug 2026 05:20:00 GMT https://vulnogram.org/CVE-2026-49431 https://vulnogram.org/CVE-2026-49431 The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream. Any local user c… Low Wed, 19 Aug 2026 05:15:37 GMT https://vulnogram.org/CVE-2026-49430 https://vulnogram.org/CVE-2026-49430 The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated Z… High Wed, 19 Aug 2026 05:15:29 GMT https://vulnogram.org/CVE-2026-49429 https://vulnogram.org/CVE-2026-49429 The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userus… High Wed, 19 Aug 2026 05:15:21 GMT https://vulnogram.org/CVE-2026-49415 https://vulnogram.org/CVE-2026-49415 During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because t… High Wed, 19 Aug 2026 04:38:24 GMT https://vulnogram.org/CVE-2026-49419 https://vulnogram.org/CVE-2026-49419 When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same referenc… High Wed, 19 Aug 2026 04:32:39 GMT https://vulnogram.org/CVE-2026-49418 https://vulnogram.org/CVE-2026-49418 When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page… High Wed, 19 Aug 2026 04:14:17 GMT https://vulnogram.org/CVE-2026-49416 https://vulnogram.org/CVE-2026-49416 The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buf… High Sat, 27 Jun 2026 09:25:12 GMT https://vulnogram.org/CVE-2026-49414 https://vulnogram.org/CVE-2026-49414 The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base ad… High Sat, 27 Jun 2026 09:22:23 GMT https://vulnogram.org/CVE-2026-49413 https://vulnogram.org/CVE-2026-49413 The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to z… High Sat, 27 Jun 2026 09:08:23 GMT https://vulnogram.org/CVE-2026-49412 https://vulnogram.org/CVE-2026-49412 The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a… High Sat, 27 Jun 2026 09:02:55 GMT https://vulnogram.org/CVE-2026-45259 https://vulnogram.org/CVE-2026-45259 sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process… Medium Sat, 27 Jun 2026 08:59:17 GMT