FreeBSD has 22 CVEs on record. Disclosure cadence is accelerating: 22 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 13. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-362 (6) and CWE-273 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 22 prev 0
Worst active — by depth score
CVE-2026-58096High· 8.8LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 171749CVE-2026-58095High· 8.8mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially e…49CVE-2026-58092High· 8.1In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group …45CVE-2026-58097High· 7.8mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially e…43CVE-2026-58094High· 7.8The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object43
FreeBSD vulnerabilities
CVEs affecting FreeBSD, newest first. Open any entry for full detail, references, and exploit status.
22 CVEsRSS
CVE-2026-101310NoneThe HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subjec…
CVE-2026-101309NoneThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurr…
CVE-2026-101311NoneThe framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values with…
CVE-2026-101308NoneWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this win…
CVE-2026-101307NoneWhen the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples in…
CVE-2026-101306NoneSCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has…
CVE-2026-101305Nonerenameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on…
CVE-2026-101304NoneWhen fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a di…
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a di…
CVE-2026-101303NoneThe IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services liste…
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services liste…
CVE-2026-101302NoneTLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invali…
CVE-2026-58099NoneWhen copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another threa…
CVE-2026-58100Nonekqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent …
CVE-2026-58098NoneWhen semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the c…
CVE-2026-58091High· 7.8The implementation of this ioctl attempts to acquire locks on all channels in a sync group
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structu…
CVE-2026-58090High· 7.8The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them
The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive so…
CVE-2026-58089High· 7.8When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes
When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user wh…
CVE-2026-58094High· 7.8The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object
The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked w…
CVE-2026-58093High· 7.0The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrent…
CVE-2026-58092High· 8.1In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group …
In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group …
CVE-2026-58097High· 7.8mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially e…
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially e…
CVE-2026-58096High· 8.8LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717
LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095…
CVE-2026-58095High· 8.8mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially e…
mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially e…