On June 30, 2026, notifications were published regarding the correction of 13 new vulnerabilities in the FreeBSD operating system.
- CVE-2026-49418. A user with access to a device that has a memory-mapped interface can cause a double-free/use-after-free in the kernel. This could potentially lead to privilege escalation.
- CVE-2026-49419. (only FreeBSD 15+) A double decrement of the refcount of the current jail during error handling while accessing another jail via the jail descriptor (introduced in FreeBSD 15), leading to an unplanned release of the jail control structure and subsequent use-after-free wherever it is used. Theoretically, this may result in privilege escalation.
- CVE-2026-49415. When executing a setuid program, access rights to its memory are set slightly later than the memory is initialized, allowing a brief window of time to access and modify it without the necessary privileges via procfs or linprocfs. In most systems, procfs, and especially libprocfs, are not mounted, so the issue likely affects very few users.
- CVE-2026-49429, CVE-2026-49430, CVE-2026-49431. (only for systems with ZFS) The first two vulnerabilities are related to allocating memory of improper size: a buffer is allocated based on a 32-bit number, and then data of the actual size is written to it, leading to overflow if the actual buffer size was greater than 4GB. Both can only be triggered by root or a user explicitly granted privileges for vulnerable operations. The third vulnerability is exploitable by anyone, allowing anyone to set the flag '$hasrecvd' on a dataset using ZFS_IOC_SET_PROP (the danger level is unclear from the announcement).
- CVE-2026-49420The lack of proper size checks before writing a packet into a fixed-size buffer in the libalias module for RTSP support allows for possible remote and unauthorized stack overflow, either of the kernel (for ipfw nat) or of the natd process (which is usually run by root). This may potentially lead to RCE. The vulnerability can be triggered by a malicious host within a NAT network implemented through libalias, forwarding malicious RTSP packets. Consequently, the vulnerability does not affect hosts where NAT is not running in any form. Also, natd will cease to be vulnerable if the line libalias_smedia.so is removed from /etc/libalias.conf and natd is restarted, and ipfw nat will not be vulnerable without loading the alias_smedia.ko module (it is not specified whether it can load it automatically). Additionally, the vulnerable handler only looks at outgoing TCP/UDP packets that have one of the ports 554 or 7070—if such packets are firewall-filtered before reaching NAT, the vulnerability will disappear.
- CVE-2026-49421The unlinkat() and funlinkat() functions did not consider the AT_RESOLVE_BENEATH flag, which should have prevented exiting the specified directory when traversing this path. Thus, files could be deleted outside the directory when the calling code intended to enforce this restriction.
- CVE-2026-49422A race condition in the tcp_rack.ko module (which is not loaded by default). Each TCP socket can individually choose the TCP stack it will work through, including switching them on the fly. If the following occurs: 1) on a socket with tcp_rack, a rack-specific setsockopt() is called, 2) in another thread, we quickly switch the TCP stack from rack to another and switch back to rack at the right moment, then the rack handler's setsockopt() will operate with the old (pre-switch) address of the socket state structure, resulting in memory corruption and potential privilege escalation. Only systems where tcp_rack.ko is explicitly loaded are vulnerable; this is not default.
- CVE-2026-49427, CVE-2026-49428POSIX largepages (shm_create_largepage) were not marked as used accurately during allocation, which could lead to their erroneous deallocation under different circumstances (calls to sendfile with the SF_NOCACHE flag, open with the O_TRUNC flag, and fspacectl) and subsequent use-after-free with typical consequences.
- CVE-2026-49426. Incorrect audit(4) logs regarding remote syscalls via ptrace(PT_SC_REMOTE) may confuse suspicious activity analysis systems if such systems are employed.
- CVE-2026-49423. Possible kernel panic when receiving data via kTLS involving TLS 1.2 CBC records. To avoid the issue, you can set kern.ipc.tls.enable=0 or kern.ipc.tls.cbc_enable=0.
- CVE-2026-49424. Data leak (104 bytes) from the kernel stack when calling linux-compat waitid(), which fails to zero out the unused part of the linux siginfo_t structure when transferring data from the freebsd structure. In standard GENERIC kernels, the linux emulator is disabled by default and is only enabled with manual module loading.
- CVE-2026-49425. Similarly to the previous case, the 32-bit kevent fails to zero out the 32-bit structure before transferring data from the native 64-bit one, resulting in a stack data leakage. By default, 32-bit compatibility is enabled in the kernel (not as a module).
- CVE-2026-58081, CVE-2026-58082. Vulnerabilities in iconv. First: many of its modules do not check the size of the output buffer provided by the calling code before writing results to it (noted: HZ, UTF-7, VIQR, ZW). Second: the ISO-2022 module uses a 6-byte stack buffer for internal operations, but up to 10 bytes can be written into it, corrupting the stack. Consequently, running iconv to convert to or from one of the mentioned encodings with unchecked input may be susceptible to buffer overflows.
Source: linux.org.ru
