Do Son 
TL;DR
The FreeBSD Project released six security advisories on August 25, 2026. Together they fix eight vulnerabilities across the kernel and ppp. Most enable local privilege escalation, while the ppp flaws may allow code execution as root. Update now.
- Total: 8 CVEs
- Severity: 8 Unrated
- Actively exploited: None confirmed
- Highest severity: Awaiting analysis — CVE-2026-58090
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-58090 | Awaiting analysis | Use-after-free in unix SOCK_STREAM message handling | p3, p13 | Not exploited |
| CVE-2026-58091 | Awaiting analysis | Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl | p3, p13, p9 | Not exploited |
| CVE-2026-58092 | Awaiting analysis | Unauthorized credential switching | p3, p13 | Not exploited |
| CVE-2026-58093 | Awaiting analysis | Kernel use-after-free via tty ioctls | p3, p13, p9 | Not exploited |
| CVE-2026-58094 | Awaiting analysis | TOCTOU race in POSIX shared memory large page configuration | p3, p13, p9 | Not exploited |
| CVE-2026-58095 | Awaiting analysis | ppp(8): incorrect length calculation in mp_Enddisc() | p3, p13, p9 | Not exploited |
| CVE-2026-58096 | Awaiting analysis | ppp(8): missing length validation in LcpDecodeConfig() | p3, p13, p9 | Not exploited |
| CVE-2026-58097 | Awaiting analysis | ppp(8): missing length validation in mp_SetEnddisc() | p3, p13, p9 | Not exploited |
Why These FreeBSD Vulnerabilities Matter
FreeBSD powers servers, storage systems, and network appliances worldwide. It also forms the base of products like pfSense and parts of major platforms. A kernel flaw here reaches a wide install base.
These FreeBSD vulnerabilities mostly need local access. Still, local privilege escalation is a key step in many attacks. An intruder who lands a low-privilege foothold can chain these bugs toward root.
How the Attacks Work
Kernel Use-After-Free and Race Bugs
Four flaws are memory-safety or race conditions in the kernel. CVE-2026-58090 is a use-after-free in unix socket message handling. CVE-2026-58091 affects the sound driver’s SNDCTL_DSP_SYNCSTART ioctl, but only on systems with multiple audio devices.
Two more involve timing. CVE-2026-58093 is a use-after-free race in tty ioctls. CVE-2026-58094 is a TOCTOU race in POSIX shared memory. Each lets an unprivileged local user escalate privileges.
Credential Switching and ppp Flaws
CVE-2026-58092 affects the mac_do policy module. Certain rules can wrongly set a process group ID to 0, the wheel group. Depending on setup, that may open a path to root.
The ppp advisory bundles three memory-safety bugs, CVE-2026-58095 through CVE-2026-58097. The project warns a malicious PPP peer could crash ppp(8) or potentially execute arbitrary code as root.
Is It Being Exploited?
No exploitation in the wild has been confirmed. The advisories report no active attacks. Likewise, no public proof-of-concept exists yet.
Affected Versions
The affected branches vary by advisory. The sound, tty, posixshm, and ppp bugs hit all supported FreeBSD versions, including 14.x and 15.x. The unix and mac_do flaws affect only FreeBSD 15.0 and later.
Patch and Mitigation Steps
No workarounds exist for most of these bugs. Update to a patched releng branch dated after the correction date, then reboot. You can find all six notices on the FreeBSD security advisories page. Base-package systems can run pkg upgrade, while others use freebsd-update.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
