Skip to content
OpenAdvisories
High WID-SEC-2026-3664 10 CVEs

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Published Sep 29, 2026 · Updated Oct 14, 2026 · Revision 3 · de-DE

Vendor: FreeBSD Vendor: Red Hat Product: Enterprise Linux Product: FreeBSD OS

Summary

Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände zu verursachen.

Product

FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-101306

    Multiple jail filesystem root escapes

    SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory fi…

    FreeBSD FreeBSD
  • High 8.8
    CVE-2026-101305

    Multiple jail filesystem root escapes

    renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is al…

    FreeBSD FreeBSD
  • High 8.4
    CVE-2026-58098

    Heap out-of-bounds access in semop(2)

    When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This …

    FreeBSD FreeBSD
  • High 8.2
    CVE-2026-84782

    DTLS Retransmits Handshake Messages From a Stale Buffer Offset

    Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspend…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-101303

    IPv6 UDP sendto(2) bypasses jail loopback restriction

    The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6…

    FreeBSD FreeBSD
  • High 7.5
    CVE-2026-84783

    Use-After-Free in X.509 Extension Cache Under Concurrent Use

    Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS cl…

    OpenSSL OpenSSL nodejs openssl-4.0-libcrypto Ubuntu Wolfi
  • High 7.1
    CVE-2026-101304

    Multiple jail filesystem root escapes

    When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor…

    FreeBSD FreeBSD
  • High 7.0
    CVE-2026-58099

    Memory safety bugs in kqueue copy-on-fork implementation

    When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while …

    FreeBSD FreeBSD
  • High 7.0
    CVE-2026-58100

    Memory safety bugs in kqueue copy-on-fork implementation

    kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's…

    FreeBSD FreeBSD
  • Medium 6.5
    CVE-2026-101302

    Remote DoS via receive-side kernel TLS

    TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an …

    FreeBSD FreeBSD

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-101857, EUVD-2026-101870, EUVD-2026-101855, EUVD-2026-101866, EUVD-2026-101867, EUVD-2026-101856, EUVD-2026-101865

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References