Skip to content
OpenAdvisories
Medium WID-SEC-2026-2165 17 CVEs

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Published Jun 30, 2026 · Updated Aug 19, 2026 · Revision 3 · de-DE

Vendor: FreeBSD Product: FreeBSD OS Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um beliebigen Programmcode auszuführen.

Product

FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Vulnerabilities 17

  • Critical 9.8
    CVE-2026-58081

    Heap based buffer overflow in iconv(3)

    Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected …

    FreeBSD FreeBSD
  • Critical 9.8
    CVE-2026-58082

    Stack based buffer overflow in iconv(3)

    The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four byte…

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-49415

    Local privilege escalation via execve(2) TOCTOU race

    During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel…

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-49418

    Use-after-free in device pager page list

    When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the…

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-49419

    Jail reference count underflow

    When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a secon…

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-49420

    Buffer overflow in libalias RTSP handler

    The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT …

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-49427

    posixshm: largepage shared memory objects not explicitly wired

    Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unpri…

    FreeBSD FreeBSD
  • High 8.4
    CVE-2026-49422

    Use-after-free in TCP RACK stack option handler

    The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-con…

    FreeBSD FreeBSD
  • High 8.4
    CVE-2026-49428

    posixshm: system calls can incorrectly free memory of largepage objects

    Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-49429

    Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl

    The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" deleg…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-49430

    Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl

    The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permis…

    FreeBSD FreeBSD
  • High 7.1
    CVE-2026-49421

    unlinkat(2) ignores AT_RESOLVE_BENEATH flag

    The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that u…

    FreeBSD FreeBSD
  • Medium 5.5
    CVE-2026-49424

    Kernel stack disclosure in Linux compatibility layer

    The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive i…

    FreeBSD FreeBSD
  • Medium 5.5
    CVE-2026-49425

    Kernel stack disclosure in 32-bit compatibility support

    The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive infor…

    FreeBSD FreeBSD
  • Low 3.3
    CVE-2026-49423

    Remote DOS via uninitialized memory access in KTLS receive

    When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entrie…

    FreeBSD FreeBSD
  • Low 3.3
    CVE-2026-49426

    Incorrect audit records for ptrace(2) syscall requests

    When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system …

    FreeBSD FreeBSD
  • Low 3.3
    CVE-2026-49431

    Incorrect user validation in ZFS_IOC_SET_PROP ioctl

    The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream. Any local user can set th…

    FreeBSD FreeBSD

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-62349, GHSA-R57R-Q66W-6QXQ

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-62229, EUVD-2026-62236, EUVD-2026-62255, EUVD-2026-62254, EUVD-2026-62244, EUVD-2026-62243, EUVD-2026-62242, EUVD-2026-62241, EUVD-2026-62240, EUVD-2026-62239, EUVD-2026-62231

  3. #1

    Initiale Fassung

References