Freebsd vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-101311 The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.High 7 · Oct 15, 2026
• CVE-2026-101310 The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.High 7 · Oct 15, 2026
• CVE-2026-101309 The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.High 7 · Oct 15, 2026
• CVE-2026-58100 kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.High 7 · Oct 15, 2026
• CVE-2026-58099 When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) beHigh 7 · Oct 15, 2026
• CVE-2026-58098 When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.High 8.4 · Oct 15, 2026
• CVE-2026-101307 When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.High 8.2 · Oct 15, 2026
• CVE-2026-101306 SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.Critical 9.8 · Oct 15, 2026
• CVE-2026-101305 renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.High 8.8 · Oct 15, 2026
• CVE-2026-101304 When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum cHigh 7.1 · Oct 15, 2026
• CVE-2026-101303 The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.High 7.5 · Oct 15, 2026
• CVE-2026-58097 mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.High 7.8 · Aug 26, 2026
• CVE-2026-58096 LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717.High 8.8 · Aug 26, 2026
• CVE-2026-58095 mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a High 8.8 · Aug 26, 2026
• CVE-2026-58094 The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object.High 7.8 · Aug 26, 2026
• CVE-2026-58093 The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock.High 7 · Aug 26, 2026
• CVE-2026-58092 In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array cHigh 8.1 · Aug 26, 2026
• CVE-2026-58091 The implementation of this ioctl attempts to acquire locks on all channels in a sync group.High 7.8 · Aug 26, 2026
• CVE-2026-58090 The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them.High 7.8 · Aug 26, 2026
• CVE-2026-58089 When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes.High 7.8 · Aug 26, 2026
• CVE-2026-58088 The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a secHigh 7.4 · Aug 19, 2026
• CVE-2026-58087 The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized fHigh 7.8 · Aug 19, 2026
• CVE-2026-58086 As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user.High 8.1 · Aug 19, 2026
• CVE-2026-58085 After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded.High 7.5 · Aug 19, 2026
• CVE-2026-58083 While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was coHigh 8.4 · Aug 19, 2026