PatchTheCVEfreebsd vulnerabilities and fixes
Recent CVEs affecting freebsd, with upgrade or downgrade steps. 10 tracked.
freebsd has 10 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-10-15. Highest priority: CVE-2026-101306 (score 44/100).
- CVE-2026-101304 HIGH 7.1 MITIGATE When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that di
- CVE-2026-101307 CRITICAL 9.1 MITIGATE When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
- CVE-2026-101306 CRITICAL 9.8 MITIGATE SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred
- CVE-2026-101305 HIGH 8.8 MITIGATE renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments
- CVE-2026-101303 HIGH 7.5 MITIGATE The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destinati
- CVE-2026-101302 MEDIUM 6.5 MITIGATE TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed
- CVE-2026-101308 MEDIUM 5.5 MITIGATE When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-m
- CVE-2026-58098 HIGH 8.4 MITIGATE When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps
- CVE-2026-58099 HIGH 7.0 MITIGATE When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (us
- CVE-2026-58100 HIGH 7.0 MITIGATE kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number
FAQ
How do I fix freebsd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is freebsd being exploited right now?
None of the tracked freebsd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which freebsd CVE should I patch first?
CVE-2026-101306 currently ranks highest (44/100): SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.