[ Vendor · 13 CVEs ]
FreeBSD
CVEs affecting FreeBSD published in the last 30 days, plus any FreeBSD CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-101309 | 15 Oct 2026 | CVSS 7.0 | FreeBSDThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use… | |
| CVE-2026-101310 | 15 Oct 2026 | CVSS 7.0 | FreeBSDThe HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an… | |
| CVE-2026-101311 | 15 Oct 2026 | CVSS 7.0 | FreeBSDThe framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync… | |
| CVE-2026-58098 | 15 Oct 2026 | CVSS 8.4 | FreeBSDWhen semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded… | |
| CVE-2026-58099 | 15 Oct 2026 | CVSS 7.0 | FreeBSDWhen copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal… | |
| CVE-2026-58100 | 15 Oct 2026 | CVSS 7.0 | FreeBSDkqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the… | |
| CVE-2026-101308 | 15 Oct 2026 | CVSS 5.5 | FreeBSDWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock… | Fix |
| CVE-2026-101302 | 15 Oct 2026 | CVSS 6.5 | FreeBSDTLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which… | Fix |
| CVE-2026-101303 | 15 Oct 2026 | CVSS 7.5 | FreeBSDThe IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6… | Fix |
| CVE-2026-101304 | 15 Oct 2026 | CVSS 7.1 | FreeBSDWhen fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the… | Fix |
| CVE-2026-101305 | 15 Oct 2026 | CVSS 8.8 | FreeBSDrenameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted… | Fix |
| CVE-2026-101306 | 15 Oct 2026 | CVSS 9.8 | FreeBSDSCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by… | Fix |
| CVE-2026-101307 | 15 Oct 2026 | CVSS 9.1 | FreeBSDWhen the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero… | Fix |