Skip to content
OpenAdvisories
High WID-SEC-2026-2590 6 CVEs

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Published Jul 29, 2026 · Updated Aug 19, 2026 · Revision 2 · de-DE

Vendor: FreeBSD Product: FreeBSD OS Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um seine Privilegien zu erhöhen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Vulnerabilities 6

  • High 8.4
    CVE-2026-58083

    Use-after-free in kqueue copy-on-fork

    While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, co…

    FreeBSD FreeBSD
  • High 8.1
    CVE-2026-58086

    ktrace(2) privilege incorrectly validated in jails

    As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the t…

    FreeBSD FreeBSD
  • High 7.8
    CVE-2026-58087

    Heap out-of-bounds access in semctl(2)

    The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had…

    FreeBSD FreeBSD
  • High 7.5
    CVE-2026-58085

    Missing MAC validation in wg(4) packet decryption

    After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. A remote attacker who c…

    FreeBSD FreeBSD
  • High 7.4
    CVE-2026-58088

    Race condition in ELF core dump segment counting

    The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the map betw…

    FreeBSD FreeBSD
  • Medium 5.5
    CVE-2026-58084

    Kernel stack disclosure via timer_settime(2)

    To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the un…

    FreeBSD FreeBSD

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-62364, GHSA-V78V-RXQ5-6W38, EUVD-2026-62339, GHSA-PH3X-QGRX-FV78, EUVD-2026-62340, GHSA-5Q67-RFF6-C784, EUVD-2026-62338, GHSA-P4V3-CW55-5MRC, EUVD-2026-62351, GHSA-J94H-9P69-VHVM

  2. #1

    Initiale Fassung

References