{"id":182553,"date":"2026-07-08T22:53:54","date_gmt":"2026-07-08T20:53:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novye-uyazvimosti-freebsd"},"modified":"2026-07-08T22:53:54","modified_gmt":"2026-07-08T20:53:54","slug":"novye-uyazvimosti-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/novye-uyazvimosti-freebsd","title":{"rendered":"New vulnerabilities in FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>          <a rel=\"nofollow\" id=\"memories_button\" href=\"#\" title=\"Track\"><i class=\"icon-bell\"><\/i><\/a><br \/>2                            <\/p>\n<p>On June 30, 2026, notifications were published regarding the correction of 13 new vulnerabilities in the FreeBSD operating system.<\/p>\n<ul>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:37.vm.asc\">CVE-2026-49418<\/a>. A user with access to a device that has a memory-mapped interface can cause a double-free\/use-after-free in the kernel. This could potentially lead to privilege escalation. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:38.jail.asc\">CVE-2026-49419<\/a>. (only FreeBSD 15+) A double decrement of the refcount of the current jail during error handling while accessing another jail via the jail descriptor (introduced in FreeBSD 15), leading to an unplanned release of the jail control structure and subsequent use-after-free wherever it is used. Theoretically, this may result in privilege escalation. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:39.execve.asc\">CVE-2026-49415<\/a>. When executing a setuid program, access rights to its memory are set slightly later than the memory is initialized, allowing a brief window of time to access and modify it without the necessary privileges via procfs or linprocfs. In most systems, procfs, and especially libprocfs, are not mounted, so the issue likely affects very few users. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:40.zfs.asc\">CVE-2026-49429, CVE-2026-49430, CVE-2026-49431<\/a>. (for systems with ZFS only) The first two errors are related to allocating incorrectly sized memory: a buffer is allocated with a size passed as a 32-bit number, and then data of the actual size is written into it, leading to overflow if the actual buffer size was more than 4GB. Both of these can only be triggered by the root user or a user with explicitly granted privileges for vulnerable operations. The third error is exploitable by anyone; it allows anyone to attach a flag &#171;$hasrecvd&#187; to a dataset using ZFS_IOC_SET_PROP (how dangerous this is, isn't clear from the announcement). <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:41.libalias.asc\">CVE-2026-49420<\/a>. The lack of proper size checking for a packet before writing it to a fixed-size buffer on the stack in the libalias module supporting RTSP allows for remote and unauthorized stack overflow, either in the kernel (for ipfw nat) or in the natd process (which is usually run by root). This could potentially lead to RCE. The vulnerability can be triggered by a malicious host within the local network behind NAT implemented via libalias, sending malicious RTSP packets. Consequently, this vulnerability does not affect hosts without NAT running in any form. Also, natd will no longer be vulnerable if the line libalias_smedia.so is removed from \/etc\/libalias.conf and natd is restarted, and ipfw nat will not be vulnerable without loading the alias_smedia.ko module (it is not specified whether it can load it automatically). Furthermore, the vulnerable handler only looks at outbound TCP\/UDP packets that have one of the ports 554 or 7070 \u2014 if such packets are firewalled before reaching NAT, the vulnerability will also disappear. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:42.unlinkat.asc\">CVE-2026-49421<\/a>The unlinkat() and funlinkat() functions did not consider the AT_RESOLVE_BENEATH flag, which should have prevented exiting the specified directory when traversing this path. Thus, files could be deleted outside the directory when the calling code intended to enforce this restriction. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:43.tcp.asc\">CVE-2026-49422<\/a>A race condition in the tcp_rack.ko module (which is not loaded by default). Each TCP socket can individually choose the TCP stack it will work through, including switching them on the fly. If the following occurs: 1) on a socket with tcp_rack, a rack-specific setsockopt() is called, 2) in another thread, we quickly switch the TCP stack from rack to another and switch back to rack at the right moment, then the rack handler's setsockopt() will operate with the old (pre-switch) address of the socket state structure, resulting in memory corruption and potential privilege escalation. Only systems where tcp_rack.ko is explicitly loaded are vulnerable; this is not default.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:44.posixshm.asc\">CVE-2026-49427, CVE-2026-49428<\/a>POSIX largepages (shm_create_largepage) were not marked as used accurately during allocation, which could lead to their erroneous deallocation under different circumstances (calls to sendfile with the SF_NOCACHE flag, open with the O_TRUNC flag, and fspacectl) and subsequent use-after-free with typical consequences.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:45.audit.asc\">CVE-2026-49426<\/a>. Incorrect audit(4) logs regarding remote syscalls via ptrace(PT_SC_REMOTE) may confuse suspicious activity analysis systems if such systems are employed.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:46.ktls.asc\">CVE-2026-49423<\/a>. Possible kernel panic when receiving data via kTLS involving TLS 1.2 CBC records. To avoid the issue, you can set kern.ipc.tls.enable=0 or kern.ipc.tls.cbc_enable=0.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:47.linux.asc\">CVE-2026-49424<\/a>. Data leak (104 bytes) from the kernel stack when calling linux-compat waitid(), which fails to zero out the unused part of the linux siginfo_t structure when transferring data from the freebsd structure. In standard GENERIC kernels, the linux emulator is disabled by default and is only enabled with manual module loading.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:48.compat32.asc\">CVE-2026-49425<\/a>. Similarly to the previous case, the 32-bit kevent fails to zero out the 32-bit structure before transferring data from the native 64-bit one, resulting in a stack data leakage. By default, 32-bit compatibility is enabled in the kernel (not as a module).<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:49.iconv.asc\">CVE-2026-58081, CVE-2026-58082<\/a>. Vulnerabilities in iconv. First: many of its modules do not check the size of the output buffer provided by the calling code before writing results to it (noted: HZ, UTF-7, VIQR, ZW). Second: the ISO-2022 module uses a 6-byte stack buffer for internal operations, but up to 10 bytes can be written into it, corrupting the stack. Consequently, running iconv to convert to or from one of the mentioned encodings with unchecked input may be susceptible to buffer overflows. <\/li>\n<\/ul>\n<p>Source: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18335229\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421 FreeBSD. CVE-2026-49418. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 memory-mapped \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043c\u043e\u0436\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c double-free\/use-after-free \u0432 \u044f\u0434\u0440\u0435. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. CVE-2026-49419. (\u0442\u043e\u043b\u044c\u043a\u043e FreeBSD 15+) \u0414\u0432\u043e\u0439\u043d\u043e\u0435 \u0443\u043c\u0435\u043d\u044c\u0448\u0435\u043d\u0438\u0435 refcount \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e jail-\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0434\u0440\u0443\u0433\u043e\u043c\u0443 jail \u043f\u043e jail [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182553","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Emin Berklin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/novye-uyazvimosti-freebsd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 FreeBSD | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/novye-uyazvimosti-freebsd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-08T20:53:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-08T20:53:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47New FreeBSD Vulnerabilities | ProHoster","description":"On June 30, 2026, notifications were published regarding the remediation of 13 new vulnerabilities in the OS.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/novye-uyazvimosti-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 FreeBSD | ProHoster","og:description":"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/novye-uyazvimosti-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-08T20:53:54+00:00","article:modified_time":"2026-07-08T20:53:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182553","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:06","updated":"2026-08-05 12:22:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=182553"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182553\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=182553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=182553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=182553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}