On May 20, 2026, FreeBSD developers announced the resolution of seven new vulnerabilities in the system. Not all of them are equally dangerous, but some are quite unpleasant.
CVE-2026-45251 — a use-after-free in select-like syscalls if their waitlist contains process descriptors (in FreeBSD 15, there are also new jail descriptors), and these descriptors were closed in another thread while the waiting syscall was still in the wait state. According to this commit, descriptors related to netmap (a driver for accelerated direct access to a network adapter) are also affected, but there is no official information on this. Process descriptors appeared in FreeBSD 9, so the vulnerability has likely existed since then. The official statement indicates that the vulnerability allows for superuser privileges. There is no way to neutralize it without a patch/update.
CVE-2026-45250 — incorrect buffer size calculation and subsequent out-of-bounds write on the stack in the setcred system call, where, despite setcred itself requiring root privileges, stack corruption occurs before the privileges are checked, thus it is accessible to everyone. This system call appeared in FreeBSD 14.3 (meaning earlier versions are not affected) and provides a way to set all user and group identifiers of the current process in one call, instead of combinations of setuid+setgid+setgroups and similar. The vulnerability allows executing malicious code in the kernel context. There is no way to neutralize it without a patch/update.
CVE-2026-45252 — lack of zero termination check before copying a string obtained from the fuse daemon into a new buffer. However, there is a check for the maximum copy size, and more than 253 extra bytes from kernel memory cannot be read. Additionally, it is possible to write up to 250 bytes in "unallocated kernel heap space". By default, FreeBSD prohibits non-root users from mounting file systems, meaning that to insert a malicious fuse daemon into the kernel, one must be root. However, if sysctl vfs.usermount=1, the system becomes vulnerable even to regular users. The danger of a fuse daemon in a jail should also be considered, where it can also be root (but this is also prohibited by default).
CVE-2026-45253 — using ptrace, there was a possibility to execute a system call with an incorrect number in a debugged process, which led to executing code in the kernel that was not intended to run as a system call, with potentially adverse effects. If security.bsd.unprivileged_proc_debug=0 is set (which is a good practice for servers anyway, and the installer even suggests this as an option), then user and jailed processes will not be able to use ptrace, leaving the vulnerability accessible only to root.
CVE-2026-45255 — command injection with root privileges in bsdinstall/bsdconfig through the names of malicious wireless networks, which were not escaped when viewing their list. To avoid encountering this vulnerability, it is sufficient not to view the list of wireless networks from bsdinstall/bsdconfig.
CVE-2026-39461, CVE-2026-45254 — vulnerabilities in the libcasper library (not in the kernel). The library is designed for safely configurable service provision to processes placed in a sandbox. One of the vulnerabilities is related to a stack buffer overflow and stack corruption due to organizing file descriptors with large numbers in this library (it was designed for numbers up to 1024 — the default limit for structures in the select syscall). The second vulnerability allows the removal of imposed constraint lists (the ideology of the library is that once constraints are imposed on a process, they can only be strengthened) cap_net.
The fixed versions of the system are numbered: 14.3-RELEASE-p14, 14.4-RELEASE-p5, and 15.0-RELEASE-p9. It is also important to note for some that the FreeBSD 13.5 release has recently been discontinued—April 30, 2026—and there are no official fixes for it (and for the 13.x branch in general). However, if for some reason you are not in a hurry to transition to the 14.x release, patches for version 14.3 are generally suitable for the 13.5 sources, and CVE-2026-45250 is not relevant for the 13th branch due to the absence of setcred().
Source: linux.org.ru
