CVEs published by FreeBSD

CVEs published by FreeBSD (CVE Numbering Authority). 45 tracked.

• CVE-2026-101304 HIGH 7.1 MITIGATE When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that di
• CVE-2026-101307 CRITICAL 9.1 MITIGATE When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
• CVE-2026-101306 CRITICAL 9.8 MITIGATE SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred
• CVE-2026-101305 HIGH 8.8 MITIGATE renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments
• CVE-2026-101303 HIGH 7.5 MITIGATE The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destinati
• CVE-2026-101302 MEDIUM 6.5 MITIGATE TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed
• CVE-2026-101308 MEDIUM 5.5 MITIGATE When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-m
• CVE-2026-58098 HIGH 8.4 MITIGATE When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps
• CVE-2026-58099 HIGH 7.0 MITIGATE When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (us
• CVE-2026-58100 HIGH 7.0 MITIGATE kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number
• CVE-2026-101311 HIGH 7.0 The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB mo
• CVE-2026-101310 HIGH 7.0 The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a
• CVE-2026-101309 HIGH 7.0 The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
• CVE-2026-58089 HIGH 7.8 MITIGATE When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned
• CVE-2026-58090 HIGH 7.8 MITIGATE The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from th
• CVE-2026-58091 HIGH 7.8 MITIGATE The implementation of this ioctl attempts to acquire locks on all channels in a sync group
• CVE-2026-58092 HIGH 8.1 MITIGATE In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group
• CVE-2026-58093 HIGH 7.0 MITIGATE The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock
• CVE-2026-58094 HIGH 7.8 MITIGATE The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object
• CVE-2026-58095 HIGH 8.8 MITIGATE mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display,
• CVE-2026-58096 HIGH 8.8 MITIGATE LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum r
• CVE-2026-58097 HIGH 7.8 MITIGATE mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflo
• CVE-2026-49418 HIGH 8.8 MITIGATE When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapp
• CVE-2026-49419 HIGH 8.8 MITIGATE When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the cal
• CVE-2026-49420 HIGH 8.8 MITIGATE The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whethe
• CVE-2026-49421 HIGH 7.1 MITIGATE The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but fai
• CVE-2026-49422 HIGH 8.4 MITIGATE The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then rea
• CVE-2026-49426 LOW 3.3 MITIGATE When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an intern
• CVE-2026-49427 HIGH 8.8 MITIGATE Pages belonging to largepage shared memory objects were not explicitly wired
• CVE-2026-49428 HIGH 8.4 MITIGATE Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory
• CVE-2026-49429 HIGH 7.8 MITIGATE The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit
• CVE-2026-49430 HIGH 7.8 MITIGATE The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit in
• CVE-2026-49431 LOW 3.3 MITIGATE The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileg
• CVE-2026-49415 HIGH 8.8 MITIGATE During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials a
• CVE-2026-58083 HIGH 8.4 MITIGATE While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued
• CVE-2026-58082 CRITICAL 9.8 MITIGATE The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character outp
• CVE-2026-58081 CRITICAL 9.8 MITIGATE Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-sup
• CVE-2026-49425 MEDIUM 5.5 MITIGATE The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct
• CVE-2026-49424 MEDIUM 5.5 MITIGATE The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t
• CVE-2026-49423 LOW 3.3 MITIGATE When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the io
• CVE-2026-58086 HIGH 8.1 MITIGATE As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user
• CVE-2026-58085 HIGH 7.5 MITIGATE After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whethe
• CVE-2026-58084 MEDIUM 5.5 MITIGATE To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for
• CVE-2026-58087 HIGH 7.8 MITIGATE The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the l
• CVE-2026-58088 HIGH 7.4 MITIGATE The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding

← Back to latest CVEs