{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "freebsd: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/freebsd--freebsd/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/freebsd--freebsd/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101311/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101311/",
   "title": "CVE-2026-101311 disclosed",
   "content_text": "The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.  Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.",
   "date_published": "2026-10-15T07:18:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101310/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101310/",
   "title": "CVE-2026-101310 disclosed",
   "content_text": "The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.  A zero-length entry caused an out-of-bounds read or write during DMA transfer processing.  BDL fields were also subject to modification by the guest after validation.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.",
   "date_published": "2026-10-15T07:18:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101309/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101309/",
   "title": "CVE-2026-101309 disclosed",
   "content_text": "The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.  The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest.  This race condition could be triggered by a guest running malicious, privileged code.\n\nA malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.",
   "date_published": "2026-10-15T07:17:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101308/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101308/",
   "title": "CVE-2026-101308 disclosed",
   "content_text": "When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.  An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.\n\nAn unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.",
   "date_published": "2026-10-15T07:08:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101307/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101307/",
   "title": "CVE-2026-101307 disclosed",
   "content_text": "When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.  Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer.  A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.\n\nA remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.",
   "date_published": "2026-10-15T07:05:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101303/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101303/",
   "title": "CVE-2026-101303 disclosed",
   "content_text": "The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.\n\nA process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.",
   "date_published": "2026-10-15T06:58:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101302/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101302/",
   "title": "CVE-2026-101302 disclosed",
   "content_text": "TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding.  The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic.\n\nA remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).",
   "date_published": "2026-10-15T06:53:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101306/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101306/",
   "title": "CVE-2026-101306 disclosed",
   "content_text": "SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.",
   "date_published": "2026-10-15T06:46:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101305/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101305/",
   "title": "CVE-2026-101305 disclosed",
   "content_text": "renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.",
   "date_published": "2026-10-15T06:46:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101304/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101304/",
   "title": "CVE-2026-101304 disclosed",
   "content_text": "When fdescfs(4) was mounted in a jail with the \"nodup\" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.",
   "date_published": "2026-10-15T06:46:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-58100/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-58100/",
   "title": "CVE-2026-58100 disclosed",
   "content_text": "kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.  Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.\n\nAn unprivileged local user may be able to exploit these races to escalate privileges.",
   "date_published": "2026-10-15T06:31:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-58099/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-58099/",
   "title": "CVE-2026-58099 disclosed",
   "content_text": "When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock.  If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.\n\nAn unprivileged local user may be able to exploit these races to escalate privileges.",
   "date_published": "2026-10-15T06:31:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-58098/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-58098/",
   "title": "CVE-2026-58098 disclosed",
   "content_text": "When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.  Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep.  This sequence number is only 15 bits wide.  If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists.  The subsequent access to a semaphore within the set may then be out of bounds.\n\nAn unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.",
   "date_published": "2026-10-15T06:15:44Z"
  }
 ]
}