Browse CVEs

HIGH 7.8 CVE-2026-49416 The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size c… FreeBSD Mitigation only Fix from $1,9502026-06-27 HIGH 7.8 CVE-2026-49414 The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than … FreeBSD Mitigation only Fix from $1,9502026-06-27 HIGH 7.1 CVE-2026-49413 The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not… FreeBSD Mitigation only Fix from $1,9502026-06-27 HIGH 7.0 CVE-2026-49417 Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could … FreeBSD Mitigation only Fix from $1,9502026-06-27 HIGH 7.8 CVE-2026-49412 The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. Du… FreeBSD Mitigation only Fix from $1,9502026-06-27 HIGH 7.8 CVE-2026-45258 dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition … FreeBSD Mitigation only Fix from $1,9502026-06-27 MEDIUM 6.5 CVE-2026-45259 sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not inc… FreeBSD Mitigation only Fix from $1,6002026-06-27 HIGH 7.8 CVE-2026-45257 The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumpti… FreeBSD Mitigation only Fix from $1,9502026-06-26 MEDIUM 5.5 CVE-2026-45256 When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not ch… FreeBSD Mitigation only Fix from $1,6002026-06-26 HIGH 8.4 CVE-2026-45253 ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the abil… FreeBSD Mitigation only Fix from $1,9502026-05-21 HIGH 7.8 CVE-2026-45251 A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread doe… FreeBSD Mitigation only Fix from $1,9502026-05-21 HIGH 7.5 CVE-2026-45255 When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the… FreeBSD Mitigation only Fix from $1,9502026-05-21 MEDIUM 6.5 CVE-2026-45254 In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" in… FreeBSD No fix yet Fix from $1,6002026-05-21 MEDIUM 5.5 CVE-2026-45252 When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list o… FreeBSD Mitigation only Fix from $1,6002026-05-21 HIGH 8.8 CVE-2026-39461 libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. Ho… FreeBSD Mitigation only Fix from $1,9502026-05-21 HIGH 7.8 CVE-2026-45250 The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied li… FreeBSD Mitigation only Fix from $1,9502026-05-21 HIGH 8.1 CVE-2026-35547 When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious pro… FreeBSD Mitigation only Fix from $1,9502026-04-30 HIGH 8.1 CVE-2026-42512 As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the ar… FreeBSD Mitigation only Fix from $1,9502026-04-30 HIGH 7.8 CVE-2026-39457 When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descrip… FreeBSD Mitigation only Fix from $1,9502026-04-30 HIGH 7.5 CVE-2026-7164 Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Re… FreeBSD Mitigation only Fix from $1,9502026-04-30 HIGH 7.8 CVE-2026-7270 An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2… FreeBSD Mitigation only Fix from $1,9502026-04-30 HIGH 8.1 CVE-2026-42511 The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. … FreeBSD Mitigation only Fix from $1,9502026-04-30 HIGH 8.4 CVE-2026-5398 The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' sessi… FreeBSD Mitigation only Fix from $1,9502026-04-22 MEDIUM 6.2 CVE-2026-6386 In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which… FreeBSD Mitigation only Fix from $1,6002026-04-22 HIGH 8.8 CVE-2026-4747 Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a sta… FreeBSD No fix yet Fix from $1,9502026-03-26 HIGH 7.5 CVE-2026-4247 When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge A… FreeBSD Mitigation only Fix from $1,9502026-03-26 HIGH 7.5 CVE-2026-4652 On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or sta… FreeBSD Mitigation only Fix from $1,9502026-03-26 HIGH 7.5 CVE-2026-2261 Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets … FreeBSD Mitigation only Fix from $1,9502026-03-09 HIGH 7.5 CVE-2026-3038 The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_stor… FreeBSD Mitigation only Fix from $1,9502026-03-09 HIGH 8.8 CVE-2025-15547 By default, jailed processes cannot mount filesystems, including nullfs(4). However, the allow.mount.nullfs option enables mounting nullfs filesyste… FreeBSD Mitigation only Fix from $1,9502026-03-09