Vulnerabilities

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.

When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.

The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding.

SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.

renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.

When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock.

When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object.

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock.

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717.

mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer.

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now t…

The implementation of this ioctl attempts to acquire locks on all channels in a sync group.

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them.

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes.

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them.

The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock.

As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user.