CVE-2026-101304 is a vulnerability in FreeBSD where mounting fdescfs(4) in a jail with the "nodup" option causes file descriptors opened via /dev/fd/N to not inherit certain security restrictions. This allows a process in a jail to potentially escape the jail's filesystem root restriction by using a directory file descriptor received from another jail.
CVE-2026-58100 is a race condition vulnerability in FreeBSD's kqueue_fork_copy_knote() function. It occurs because the function indexes the child's file descriptor table using a knote's file descriptor number without performing bounds checking. This can lead to an out-of-bounds read if a concurrent thread in the parent process grows the parent's file descriptor table and registers knotes with file descriptor numbers beyond the child's table size. An unprivileged local user may exploit this race condition to escalate privileges.
CVE-2026-58099 is a race condition vulnerability in FreeBSD affecting the copying of knotes from a parent kqueue to a child. The flaw arises because marker knotes, which track list traversal positions internally, were not properly excluded before being marked as in-flux and releasing the kqueue lock. This can lead to use-after-free conditions if another thread frees a marker while the lock is dropped. An unprivileged local user could exploit this to escalate privileges on the system.
CVE-2026-58088 is a race condition vulnerability in FreeBSD's ELF core dump code. The flaw arises because the code counts dumpable VM map entries and allocates a buffer, then iterates again to populate program headers. A process sharing the address space via rfork(2) can modify the map between these passes, causing an out-of-bounds write on the kernel heap. This can be triggered by an unprivileged local user sharing an address space with a process that dumps core, potentially leading to privilege escalation.
CVE-2026-58087 is an integer underflow vulnerability in FreeBSD's semctl(2) system call affecting the GETALL and SETALL commands. The flaw arises due to sequence number wrapping after 0x8000 create/destroy cycles of semaphore sets, allowing an attacker to bypass validation and cause out-of-bounds reads and writes on kernel heap memory. This can be exploited by an unprivileged local user to potentially escalate privileges. The vulnerability affects FreeBSD versions 14.4-RELEASE, 15.0-RELEASE, and 15.1-RELEASE. It has a high severity rating with a CVSS score of 7.8. No patch information is provided in the input data.
CVE-2026-58086 is a vulnerability in FreeBSD where the PRIV_KTRACE privilege is always denied to a jailed root user due to an unintended side effect of a code change. This causes tracing configured by a jailed root user to not be recognized as privileged. Consequently, an unprivileged user within the same jail who has permission to debug a target process can alter or disable the jailed root user's tracing flags, preventing reliable tracing of unprivileged processes by the jailed root user.
CVE-2026-58085 is a vulnerability in the FreeBSD wg(4) driver where it fails to verify the success of the MAC (Poly1305) authentication tag during packet decryption. This flaw allows a remote attacker who can send UDP packets to a WireGuard endpoint and guess the receiver's replay window bounds to inject forged or modified transport data packets into the tunnel. Additionally, an attacker intercepting WireGuard packets can modify ciphertext and authenticated data without detection.
CVE-2026-58084 is a vulnerability in FreeBSD 15.0-RELEASE and 15.1-RELEASE where the kernel fails to check for errors when retrieving the previous timer value for CLOCK_TAI timers. This leads to copying uninitialized kernel stack memory to userspace, allowing an unprivileged local user to potentially disclose sensitive kernel data.
CVE-2026-58083 is a use-after-free vulnerability in the FreeBSD kernel related to the handling of knotes during the fork operation. A timer-based knote could be enqueued twice due to a race condition and improper locking, leading to corruption of the kqueue's active list. This flaw allows an unprivileged local user to trigger a kernel use-after-free, potentially resulting in privilege escalation.
A stack-based buffer overflow vulnerability exists in the ISO-2022 encoding module of FreeBSD's iconv(3) implementation. The module uses a fixed 6-byte stack buffer for intermediate character output, but some ISO-2022 variants require up to 10 bytes per character. This mismatch can cause a buffer overflow of up to four bytes when converting untrusted input using affected encoding modules. The vulnerability affects specific FreeBSD release versions.
CVE-2026-58081 is a critical heap-based buffer overflow vulnerability in FreeBSD's iconv encoding modules for HZ, UTF-7, VIQR, and ZW. These modules fail to properly check the size of the output buffer before writing converted characters. Applications using iconv(3) with untrusted input and affected encodings may be vulnerable to buffer overflows, potentially leading to severe impacts on confidentiality, integrity, and availability.
CVE-2026-49425 is a vulnerability in FreeBSD's compat32 kevent() handler where a 64-bit kevent struct is translated into a 32-bit struct on the stack without zeroing it first. This leads to the potential exposure of uninitialized kernel stack data to unprivileged users, which may contain sensitive information. The flaw affects FreeBSD versions 14.3-RELEASE, 14.4-RELEASE, and 15.0-RELEASE. The vulnerability has a medium severity with a CVSS score of 5.5.
CVE-2026-49424 is a vulnerability in FreeBSD where the Linux waitid() implementation translates a FreeBSD siginfo_t struct into a Linux siginfo_t on the stack without zeroing the stack memory first. This results in an uninitialized resource use, allowing an unprivileged user to potentially observe 104 bytes of kernel stack data that may contain sensitive information.
CVE-2026-35547 is a heap-based buffer overflow vulnerability in FreeBSD's libnv component. The flaw arises from improper validation of the message size when processing incoming message headers. This can lead to out-of-bounds writes on the heap, potentially causing system crashes or panics. An unprivileged attacker might exploit this vulnerability to escalate privileges on the affected system.
CVE-2026-39457 is a stack-based buffer overflow vulnerability in FreeBSD's libnv library. It occurs because libnv uses select(2) to wait for data on a socket without verifying that the socket descriptor is within the FD_SETSIZE limit (1024). An attacker who can cause an application using libnv to allocate large file descriptors may trigger stack corruption. If the vulnerable application is setuid-root, this flaw could be exploited for local privilege escalation.
CVE-2026-42512 is a heap-based buffer overflow vulnerability in FreeBSD's dhclient component. The flaw occurs when dhclient resizes an array of string pointers incorrectly, causing a heap buffer overrun. A specially crafted network packet can trigger this overflow, potentially leading to a crash or remote code execution.
CVE-2026-7164 is a vulnerability in FreeBSD involving uncontrolled recursion during SCTP chunk parameter parsing when pf is configured to process traffic. This flaw can cause a stack overflow leading to a system panic. Remote attackers can exploit this by sending crafted packets, causing denial of service on affected systems.
CVE-2026-7270 is a high-severity vulnerability in the FreeBSD kernel caused by an operator precedence logic error. This flaw leads to a buffer overflow condition where attacker-controlled data can overwrite adjacent execve(2) argument buffers. An unprivileged user may exploit this vulnerability to gain superuser privileges, posing a significant security risk. The affected versions include FreeBSD 15.0-RELEASE, 14.4-RELEASE, 14.3-RELEASE, and 13.5-RELEASE. No public exploits or patches are currently documented.
CVE-2026-42511 is a vulnerability in FreeBSD's dhclient where the BOOTP file field is written to the lease file without escaping embedded double-quotes. This allows injection of arbitrary dhclient.conf directives. When the lease file is re-parsed, such as after a system restart, attacker-controlled input can be executed by dhclient-script(8) with root privileges. A rogue DHCP server could exploit this to execute arbitrary code as root on affected systems.
CVE-2024-51566 is a vulnerability in the FreeBSD NVMe driver queue processing that allows guest input to cause infinite loops due to improper validation of specified index, position, or offset. This can lead to denial of service conditions. The flaw affects FreeBSD versions 13.3-RELEASE, 13.4-RELEASE, and 14.1-RELEASE. The CVSS score is 6.5, indicating a medium severity impact primarily on availability.