git: f446be27a6 - main - Add EN-26:20, EN-26:21, and SA-26:56 through SA-26:63.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 25 Aug 2026 18:26:40 UTC
The branch main has been updated by gordon:
URL: https://cgit.FreeBSD.org/doc/commit/?id=f446be27a6b74932da15054a6d3497bba7a86e83
commit f446be27a6b74932da15054a6d3497bba7a86e83
Author: Gordon Tetlow <gordon@FreeBSD.org>
AuthorDate: 2026-08-25 18:25:39 +0000
Commit: Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2026-08-25 18:25:39 +0000
Add EN-26:20, EN-26:21, and SA-26:56 through SA-26:63.
Approved by: so
---
website/data/security/advisories.toml | 32 +
website/data/security/errata.toml | 8 +
.../advisories/FreeBSD-EN-26:20.microcode.asc | 202 ++++
.../advisories/FreeBSD-EN-26:21.openssl.asc | 140 +++
.../security/advisories/FreeBSD-SA-26:56.hwpmc.asc | 155 +++
.../security/advisories/FreeBSD-SA-26:57.unix.asc | 142 +++
.../security/advisories/FreeBSD-SA-26:58.sound.asc | 149 +++
.../advisories/FreeBSD-SA-26:59.mac_do.asc | 176 +++
.../security/advisories/FreeBSD-SA-26:60.ppp.asc | 168 +++
.../advisories/FreeBSD-SA-26:61.openssl.asc | 184 +++
.../security/advisories/FreeBSD-SA-26:62.tty.asc | 149 +++
.../advisories/FreeBSD-SA-26:63.posixshm.asc | 151 +++
.../security/patches/EN-26:20/microcode.patch | 61 +
.../security/patches/EN-26:20/microcode.patch.asc | 17 +
.../static/security/patches/EN-26:21/openssl.patch | 31 +
.../security/patches/EN-26:21/openssl.patch.asc | 17 +
.../security/patches/SA-26:56/hwpmc-14.patch | 116 ++
.../security/patches/SA-26:56/hwpmc-14.patch.asc | 17 +
.../security/patches/SA-26:56/hwpmc-15.patch | 116 ++
.../security/patches/SA-26:56/hwpmc-15.patch.asc | 17 +
.../static/security/patches/SA-26:57/unix.patch | 456 ++++++++
.../security/patches/SA-26:57/unix.patch.asc | 17 +
.../static/security/patches/SA-26:58/sound.patch | 58 +
.../security/patches/SA-26:58/sound.patch.asc | 17 +
.../static/security/patches/SA-26:59/mac_do.patch | 11 +
.../security/patches/SA-26:59/mac_do.patch.asc | 17 +
website/static/security/patches/SA-26:60/ppp.patch | 63 ++
.../static/security/patches/SA-26:60/ppp.patch.asc | 17 +
.../security/patches/SA-26:61/openssl-14.patch | 775 +++++++++++++
.../security/patches/SA-26:61/openssl-14.patch.asc | 17 +
.../security/patches/SA-26:61/openssl-15.patch | 1173 ++++++++++++++++++++
.../security/patches/SA-26:61/openssl-15.patch.asc | 17 +
website/static/security/patches/SA-26:62/tty.patch | 30 +
.../static/security/patches/SA-26:62/tty.patch.asc | 17 +
.../security/patches/SA-26:63/posixshm.patch | 89 ++
.../security/patches/SA-26:63/posixshm.patch.asc | 17 +
36 files changed, 4839 insertions(+)
diff --git a/website/data/security/advisories.toml b/website/data/security/advisories.toml
index 7c3d11c7c1..04564bc272 100644
--- a/website/data/security/advisories.toml
+++ b/website/data/security/advisories.toml
@@ -1,6 +1,38 @@
# Sort advisories by year, month and day
# $FreeBSD$
+[[advisories]]
+name = "FreeBSD-SA-26:63.posixshm"
+date = "2026-08-25"
+
+[[advisories]]
+name = "FreeBSD-SA-26:62.tty"
+date = "2026-08-25"
+
+[[advisories]]
+name = "FreeBSD-SA-26:61.openssl"
+date = "2026-08-25"
+
+[[advisories]]
+name = "FreeBSD-SA-26:60.ppp"
+date = "2026-08-25"
+
+[[advisories]]
+name = "FreeBSD-SA-26:59.mac_do"
+date = "2026-08-25"
+
+[[advisories]]
+name = "FreeBSD-SA-26:58.sound"
+date = "2026-08-25"
+
+[[advisories]]
+name = "FreeBSD-SA-26:57.unix"
+date = "2026-08-25"
+
+[[advisories]]
+name = "FreeBSD-SA-26:56.hwpmc"
+date = "2026-08-25"
+
[[advisories]]
name = "FreeBSD-SA-26:55.elf"
date = "2026-07-29"
diff --git a/website/data/security/errata.toml b/website/data/security/errata.toml
index 92aafdccb4..95f39afe6f 100644
--- a/website/data/security/errata.toml
+++ b/website/data/security/errata.toml
@@ -1,6 +1,14 @@
# Sort errata notices by year, month and day
# $FreeBSD$
+[[notices]]
+name = "FreeBSD-EN-26:21.openssl"
+date = "2026-08-25"
+
+[[notices]]
+name = "FreeBSD-EN-26:20.microcode"
+date = "2026-08-25"
+
[[notices]]
name = "FreeBSD-EN-26:19.zfs"
date = "2026-07-29"
diff --git a/website/static/security/advisories/FreeBSD-EN-26:20.microcode.asc b/website/static/security/advisories/FreeBSD-EN-26:20.microcode.asc
new file mode 100644
index 0000000000..1720320815
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:20.microcode.asc
@@ -0,0 +1,202 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:20.microcode Errata Notice
+ The FreeBSD Project
+
+Topic: Early loading of Intel CPU microcode fails for some CPUs
+
+Category: core
+Module: ucode
+Announced: 2026-08-25
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-06-15 18:01:43 UTC (stable/15, 15.1-STABLE)
+ 2026-08-25 16:01:16 UTC (releng/15.1, 15.1-RELEASE-p3)
+ 2026-08-25 16:00:56 UTC (releng/15.0, 15.0-RELEASE-p13)
+ 2026-07-14 14:56:07 UTC (stable/14, 14.4-STABLE)
+ 2026-08-25 16:00:22 UTC (releng/14.4, 14.4-RELEASE-p9)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+Modern x86 CPUs support updates to their microcode. FreeBSD can apply these
+updates in two ways: "early loading," performed by the kernel during boot
+before CPU feature detection, and "late loading," performed after boot by
+cpucontrol(8) or the microcode_update rc(8) service.
+
+An Intel microcode distribution file may describe the CPUs an update applies
+to using a primary signature in the image header and, optionally, an extended
+signature table listing additional matching signatures.
+
+II. Problem Description
+
+The kernel's early-loading matcher, ucode_intel_match() in
+sys/x86/x86/ucode.c, contained an inverted bounds check that caused the
+extended signature table to always be treated as absent. Consequently, a CPU
+whose matching signature+platform pair appears only in an image's extended
+signature table was never matched during early loading, and its microcode
+update was not applied. The kernel reports "CPU microcode: no matching
+update found" in this case.
+
+Late loading via cpucontrol(8) is not affected. There, the userland matcher
+parses extended signature tables correctly.
+
+III. Impact
+
+On affected Intel CPUs, early loading applies no microcode update even when a
+suitable update is present in the loaded file. Such systems run with only
+the microcode installed by the system firmware (BIOS/UEFI), which may be
+older than the packaged update and may lack functional or security-related
+errata fixes. At the time of writing, 19 CPU signatures / 58
+signature+platform combinations in the packaged Intel microcode are affected,
+spanning various Alder Lake, Raptor Lake, Sapphire Rapids, and Emerald Rapids
+steppings, as well as some newer Intel Core Ultra client processors.
+
+To determine whether your system is affected, run the following commands as
+root:
+
+# kldload -n cpuctl
+# cpucontrol -i 0x01 /dev/cpuctl0
+
+If the first hexadecimal value (the CPUID signature) appears in the
+following list, the system is affected by the bug.
+
+0x000806f4
+0x000806f5
+0x000806f6
+0x000806f7
+0x00090675
+0x000906a4
+0x000b0674
+0x000b06a3
+0x000b06a8
+0x000b06f2
+0x000b06f5
+0x000b06f6
+0x000b06f7
+0x000c0652
+0x000c0664
+0x000c06a2
+0x000c06c2
+0x000c06c3
+0x000c06f1
+
+Note, for signature 0x000906a4, only systems with platform ID 7 are
+affected. These report 0x001c0000 as the first value in the output of
+"cpucontrol -m 0x17 /dev/cpuctl0".
+
+Systems whose CPU signature matches an image's primary header, and all
+AMD systems, are unaffected.
+
+IV. Workaround
+
+Use late loading instead of, or in addition to, early loading. Install both
+sysutils/cpu-microcode-intel and sysutils/cpu-microcode-rc and enable the
+service:
+
+# sysrc microcode_update_enable="YES"
+# service microcode_update start
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date, and reboot the system.
+
+Perform one of the following:
+
+1) To update your system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r now
+
+2) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r now
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch.asc
+# gpg --verify microcode.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 2a1eaaf331f7 stable/15-n283974
+releng/15.1/ a0e96483e2ce releng/15.1-n283597
+releng/15.0/ 4a66af1ce037 releng/15.0-n281100
+stable/14/ 38cbd2588f0b stable/14-n274496
+releng/14.4/ c905b341204e releng/14.4-n273756
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://reviews.freebsd.org/D57209>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:20.microcode.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XAbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvse4P/isqmBRUFLLUnVFS/AD7
+Wlg20e54L4CRORCqhL1p33WdcKs6bHg7Tgvutwy23HmX9ISrOanm5WkFq2qN16qc
+olNJDvlXHLeIseDH6WQrxWiBooYqqJpLOJyolqB+R0TIGRvRMidbdM24gHyOCWST
+MvraPYkqkQH9DSO1CYUHoLTcVLek/l9ux1p2WApHSqOw7GPcltiYUnyvKrOqBxYs
+DD4n0GIw0JfsXK1L9MLXJILjROUpItDHnv1CsG8VVaWQI0c+5826dTVoFsDQ1RUc
+mcIiBiWP/gmKxl48wzjq9qZccGN2vHMLrFYA0Zu/syqpB2g5b0zQbm9iKIak+YIJ
+mKHTUGAZ0YJpQAXf8f1q+pED91Veh9k0fIvnSwsDa2dfgk2XMfZeWIyHbddxS0p6
+fvnCroT4sMvequ2wpC64jpebASmwjiZYYY9gPk2TdgOlu83PnYUkMbT4gv5RHgIo
+qwK7WQ2bDO3GaRHGQ3Zfo/Dl97bGg6KDDZZEbFOBv9hWu2bKgmLMvo2HtgKGGLDa
+UBGypDYWC0abbtbaqTBFtJsvUbcpf6llG/lJT6YaipVrqBjLyNFJhETS1zNIQQSr
+Y8pvUc+tsqlLmrI4AaqcvIwC0OY6ATppQ49ZMpujaDf3nj9wG9vw6d1l12kIWjEE
+0XE3NnDLvAne7G2cC+ktwGzB
+=KmJ4
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-26:21.openssl.asc b/website/static/security/advisories/FreeBSD-EN-26:21.openssl.asc
new file mode 100644
index 0000000000..091a6833ac
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:21.openssl.asc
@@ -0,0 +1,140 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:21.openssl Errata Notice
+ The FreeBSD Project
+
+Topic: OpenSSL pkg-config files contain incorrect versions
+
+Category: contrib
+Module: openssl
+Announced: 2026-08-25
+Affects: FreeBSD 14.4
+Corrected: 2026-08-07 19:37:45 UTC (stable/14, 14.4-STABLE)
+ 2026-08-25 16:00:23 UTC (releng/14.4, 14.4-RELEASE-p9)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a
+collaborative effort to develop a robust, commercial-grade, full-featured
+Open Source toolkit for the Transport Layer Security (TLS) protocol. It is
+also a general-purpose cryptography library.
+
+Alongside the libraries, the base system installs the pkg-config metadata
+files libcrypto.pc, libssl.pc, and openssl.pc in /usr/libdata/pkgconfig.
+These record the compiler and linker flags needed to build against OpenSSL,
+along with the version installed.
+
+II. Problem Description
+
+The pkg-config files are no longer generated at build time and are instead
+maintained in the source tree. The copies checked in on FreeBSD 14 were
+taken from the OpenSSL 3.5 branch and reported version 3.5.1, while the
+OpenSSL release actually installed on that branch is 3.0.x.
+
+III. Impact
+
+Software that queries pkg-config to determine the installed OpenSSL version
+is told 3.5.1, and may assume interfaces that OpenSSL 3.0 does not provide.
+A build gated on the reported version can fail to compile or link, or select
+a code path unsuited to the installed library. The OpenSSL libraries
+themselves are correct and unaffected.
+
+IV. Workaround
+
+The version can be corrected in place by editing the Version: line in
+/usr/libdata/pkgconfig/libcrypto.pc, libssl.pc, and openssl.pc to match the
+version reported by openssl(1). Systems that do not build software against
+the base system OpenSSL are not affected.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date. No reboot is required.
+
+Perform one of the following:
+
+1) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+[FreeBSD 14.4]
+# fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch.asc
+# gpg --verify openssl.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ 2e04d9868823 stable/14-n274843
+releng/14.4/ 357aa8af5304 releng/14.4-n273757
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297144>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:21.openssl.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XcbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvveEQANAsU2LZOxLqjTPrYqlX
+3/I8qWIaPJtl4zSFsgdHu2OwXUqxlY9+O24OO/0CrjC+0aC5cHtKao7/+59n0HAF
+Do8EAKduRTWlt+/+VkIc+BuDi/iUnYseYleBZ5lyb16NhwMUYuAgST7M39NgoSmY
+b521yI7H/d7NxKZ+qKG10/f1xGXIkAms+RrEbRwoxoFWHj8rpsOMwYl7zPRBenBi
+RmcEILQzjtqSunuy7BEPBpjlx6u8vbaLcer38mqPMA4EjUTw9HdTlwj4ND+rmCT6
+fahABXBm1eugESTuowmb2fNpuyLWi8YEr8VFknN72NB+AoPHkdeAvjWghvLVvtc0
+mU0wEqs7Mz04TGHwKJ3Tx+dyE/UlhDK8oZm19aWVZfB66h81orISfUFlB7F343yf
+t0/6z/Z/C4M3srB4z4woX5fJaIrs10yubt2HH/Jvrq4XslfCgD9U3NdXkhzHJBam
+r8HmKpsnQcmVI3ebhjfoHLLbPc73pXND/jLpc8VvqVNNNh5vwMFFnb6rq46GxfZI
+GfClFjF6u2/Hgf6WkJCd65iNb/fiFHUuxjwSkFTMWvbpP580NtOG5p2Lq5ksyxfz
+Jr76q3Fx+zJItwMmywwt0m6oJiJgDDNG8WT7goTpDn3/VMJs6mpyP8XUmIWGQN0F
+PO/wgtwmKw2HwVKwCfskM4tk
+=hF2I
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:56.hwpmc.asc b/website/static/security/advisories/FreeBSD-SA-26:56.hwpmc.asc
new file mode 100644
index 0000000000..1aa3de2c53
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:56.hwpmc.asc
@@ -0,0 +1,155 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:56.hwpmc Security Advisory
+ The FreeBSD Project
+
+Topic: hwpmc fails to detach PMCs during exec credential transitions
+
+Category: core
+Module: hwpmc
+Announced: 2026-08-25
+Credits: Alexander Leidinger
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-08-25 15:59:47 UTC (stable/15, 15.1-STABLE)
+ 2026-08-25 16:01:17 UTC (releng/15.1, 15.1-RELEASE-p3)
+ 2026-08-25 16:00:57 UTC (releng/15.0, 15.0-RELEASE-p13)
+ 2026-08-25 16:00:00 UTC (stable/14, 14.4-STABLE)
+ 2026-08-25 16:00:24 UTC (releng/14.4, 14.4-RELEASE-p9)
+CVE Name: CVE-2026-58089
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+The hwpmc(4) driver implements support for hardware performance
+monitoring counters (PMCs). These counters can be used to collect
+fine-grained performance data about a running process. Unprivileged
+processes may attach PMCs to themselves or, subject to restrictions,
+to other processes.
+
+II. Problem Description
+
+When a process calls execve(2) to execute a setuid or setgid image,
+hwpmc(4) is supposed to detach PMCs owned by unprivileged processes.
+An inverted check meant that this scenario was not handled properly.
+
+III. Impact
+
+An unprivileged local user who has attached PMCs to a process can
+continue monitoring it after the process executes a setuid or setgid
+binary, contrary to the intended policy.
+
+IV. Workaround
+
+No workaround is available. Systems that do not use hwpmc(4) are not
+affected.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+[FreeBSD 15.x]
+# fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-15.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-15.patch.asc
+# gpg --verify hwpmc-15.patch.asc
+
+[FreeBSD 14.x]
+# fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-14.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-14.patch.asc
+# gpg --verify hwpmc-14.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 87bb4aa63ac7 stable/15-n285143
+releng/15.1/ e034ae898328 releng/15.1-n283598
+releng/15.0/ 57a2373f86ac releng/15.0-n281101
+stable/14/ 5eaecdb275d3 stable/14-n275045
+releng/14.4/ 97e1e603bd40 releng/14.4-n273758
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-58089>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:56.hwpmc.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XkbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvyS8QAJsPGY/8wHJ68UEVlA1E
+ErNiUMinhBy8aILiGhHE9SQjgKRh/RPvFyJMcjDbIaYRlAdyL1GNKgv8+cfK9VPX
+XdC2WsK1roLvKS5qEfQu9BNLB4pXFT0vtrfX2leEDdI2imZAXRN94VEhGFS+7hFn
+L+pDhFMKQmi9Rimzmtg3EJyxvh05FMZc0oyjI0wYT8vPIYDq73mFVYIKScpPZFFc
+Cm5RKTfZ0X8Xc2EtP2p8KvXi44A7iwPQnbJ3sm/A8Q8zxv0kK+cFWXiIkV1dTzA5
+w2NRBRFaAamNXKTx2VirDHp9bb5bjw6esABeWKrS7jdLJpmEXHoJ8P55Oti+aLya
+hsJpvO4Ewrx7xVS6RGXrJCB04rvDWMkt/b8j670yQyrjvjGjPGCVpS5PeS/LcJG3
+aXpqIn88q6b9pULduYyuTygiSRFDu9W6bicgjyucoOdF9wP99auJnsyF6bu0tnnc
+HI8f95/39Iz7GR1Ra2bWGfXr3K0savJpGKxon8kdcHCk/HTIbq3oo8mqWKsfYnBy
+7s+w4lb/FGIXddZbYYhLrbJvWNvq2TI2HlXz/AJzlUEnnm8IznvkRlJ/AQtkgDHS
+I3mA7dnpnIzKnIv5P54LUBCIUFl89Ry65aKdCnWgM64FgqgRBq4u6mDYl/fOBBPp
+Z0TtIs7yRcatGRez2+WsVpIb
+=TEZX
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:57.unix.asc b/website/static/security/advisories/FreeBSD-SA-26:57.unix.asc
new file mode 100644
index 0000000000..9ff6842b04
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:57.unix.asc
@@ -0,0 +1,142 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:57.unix Security Advisory
+ The FreeBSD Project
+
+Topic: Use-after-free in unix SOCK_STREAM message handling
+
+Category: core
+Module: unix
+Announced: 2026-08-25
+Credits: Mark Johnston
+Affects: FreeBSD 15.0 and later
+Corrected: 2026-08-24 16:29:47 UTC (stable/15, 15.1-STABLE)
+ 2026-08-25 16:01:22 UTC (releng/15.1, 15.1-RELEASE-p3)
+ 2026-08-25 16:01:01 UTC (releng/15.0, 15.0-RELEASE-p13)
+CVE Name: CVE-2026-58090
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+Unix domain sockets provide a mechanism for processes on the same host
+to communicate. Processes can use unix domain sockets to exchange file
+descriptors, using the SCM_RIGHTS control message type.
+
+II. Problem Description
+
+The SOCK_STREAM receive path in the unix socket implementation
+failed to fully detach control messages from the socket buffer before
+processing them. Some error paths would free those messages, leaving
+freed data mbufs in the receive socket buffer.
+
+III. Impact
+
+An unprivileged local user can exploit this use-after-free to escalate
+privileges.
+
+IV. Workaround
+
+No workaround is available.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/SA-26:57/unix.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:57/unix.patch.asc
+# gpg --verify unix.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 06833c3e9813 stable/15-n285079
+releng/15.1/ 0e4c26a82cb1 releng/15.1-n283602
+releng/15.0/ 21de91422ca2 releng/15.0-n281105
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-58090>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:57.unix.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3X0bFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvlAsP/1eqhZQS/YtepDbHml3h
+Cjuzc3eHFelAfDhMDaAn1/KJv6fUNHaJ3NQipdKL9hU78tXKIG287Ld3BpExBvp/
+7ODQiYENW94Nx07sm0HL9Qa0lznAQtUsniZ2mlua9+t00eYnEHd8qJkeL369IGhI
+qfpeIjbELLS6kkC8r6LVEI0ncDmeieXBcL20amwSASzWarw6HpWucF6zot/FOfUE
+S6hn8fLO+IQj+min9DzMGjNDq3r/dqDKXMXv68+En+5dhmO4HMOSibfTa1YdKfW4
+SJziul0mOfaMWMCssd3b2HN5SHe9vx4vtf7TpBWfAvREbF3F95eelTzKrEkS+8Vx
+CvK6ApUukBG/866bATVri2bXnnnVuERXxi/1vMevd7dDcCZWrg/FKquoqzl/n1AD
+MM0U5PCn3PdCFJDNlNf8+ShYv9uFA6w7S2CJAkGW2oNdR9WKZcOHu4bwvxBod2hj
+xhk7xZ+hzv5Fb7ulf2bsi87BhDWrkOvRmCHh5oRKbGX/FrvUx3V1OCuFbnORxCJT
+g2MQOl7jBhhf0Gagy1bOIrqw/JH3m1Y2Lk6FgJLfNF6R1YJbWZg5oV3WIraUBr25
+EruKOmOw4CTwL0hpUX2+wO1+/QaoW1JDb3GC7wSADRNNMCnTCtFJvNS+f+jcOchL
+usbogTLMhfpofgBignADKZsd
+=7aT1
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:58.sound.asc b/website/static/security/advisories/FreeBSD-SA-26:58.sound.asc
new file mode 100644
index 0000000000..d6f5e8fa78
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:58.sound.asc
@@ -0,0 +1,149 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:58.sound Security Advisory
+ The FreeBSD Project
+
+Topic: Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
+
+Category: core
+Module: sound
+Announced: 2026-08-25
+Credits: Hazley Samsudin of GovTech CSG
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-08-25 15:59:48 UTC (stable/15, 15.1-STABLE)
+ 2026-08-25 16:01:23 UTC (releng/15.1, 15.1-RELEASE-p3)
+ 2026-08-25 16:01:02 UTC (releng/15.0, 15.0-RELEASE-p13)
+ 2026-08-25 16:00:01 UTC (stable/14, 14.4-STABLE)
+ 2026-08-25 16:00:25 UTC (releng/14.4, 14.4-RELEASE-p9)
+CVE Name: CVE-2026-58091
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+FreeBSD provides audio support through the sound(4) driver, which
+presents each audio device as a set of character device nodes such as
+/dev/dsp. The SNDCTL_DSP_SYNCSTART ioctl(2) allows multiple audio
+channels to start playback or capture in unison.
+
+II. Problem Description
+
+The implementation of this ioctl attempts to acquire locks on all
+channels in a sync group. If locking a channel would block, it
+releases the sync group list lock and sleeps. Upon reawakening,
+it is possible that the sync group structure is freed, but the
+implementation did not handle this possibility.
+
+III. Impact
+
+On a system with a multiple audio devices, an unprivileged local user
+can exploit this use-after-free to escalate privileges.
+
+IV. Workaround
+
+No workaround is available. Systems with zero or one sound devices are
+unaffected.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/SA-26:58/sound.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:58/sound.patch.asc
+# gpg --verify sound.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ edff72e5f64c stable/15-n285144
+releng/15.1/ 48c25324ff1c releng/15.1-n283603
+releng/15.0/ 0e8a1c849c3b releng/15.0-n281106
+stable/14/ e6c1c9215557 stable/14-n275046
+releng/14.4/ 8668302cb731 releng/14.4-n273759
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-58091>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:58.sound.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3X8bFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv1hoP/2n3UttE8MGyTmxBPyzv
+GdZ4aifJnXDu0Jtj59NvExOAjIqq3ltoICXjsj8Cn7fs5socSG6CYiu3ONjo/c02
+njCdMi8kz4QzP/CqQKtcwfIAUZgmYG+aTTq20Y/2SgzcGHpnvLBNbvytyjrKt8ZF
+zsYhHJ7enpKrbcQ077KHWeZlGF9fOjWaxJJRL4Zl6QdJL5AUROhoLCBYZGKkCtB8
+nl7e/zKzlLySO9G/1NBJ8rzikhFsijq1v78fPLXQWW956IIcs96EbKtMorfsRgC4
+306vIW+pa/IDLE18onog2c0BaEbulwqCOlPB0En2E8pH5n04NZ3pAZnnFQMke3ja
+DKUhgSmt4hzWunVL+viPnYHu/UcZCrqLORRDLYbBNlBPhkDY7kCRgIkHlH2T0n94
+owlSfgD6COLFf+IzgSiCFGI/OQ4cArseDddNCxHsFQEz7DPdjqmZYepBnWWVBpBL
+1ct9W/XKS5blpolUefhyDndgjvCC5eqeHMh9nqDwWGcHURG53p54lhNYE4f1Mzsw
+ZKUGf/e05Q8rw5Kncjx4S53qrbKeHdTFdbhkD4W9oUhh24IVsbOn0AqjgSPnEn0Y
+yjdHoj1gxaghZWZj57I1yuPknC1YgOY7Q/EOGSCH/oW2kAg3w025LCvXvvf2ZYhK
+duROmGXsexVjXRJQfy6XOjwH
+=ThT7
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:59.mac_do.asc b/website/static/security/advisories/FreeBSD-SA-26:59.mac_do.asc
new file mode 100644
index 0000000000..204086577f
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:59.mac_do.asc
@@ -0,0 +1,176 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:59.mac_do Security Advisory
+ The FreeBSD Project
+
+Topic: Unauthorized credential switching
+
+Category: core
+Module: mac_do
+Announced: 2026-08-25
+Credits: Hazley Samsudin of GovTech CSG
+Affects: FreeBSD 15.0 and later
+Corrected: 2026-08-25 15:59:49 UTC (stable/15, 15.1-STABLE)
+ 2026-08-25 16:01:24 UTC (releng/15.1, 15.1-RELEASE-p3)
+ 2026-08-25 16:01:03 UTC (releng/15.0, 15.0-RELEASE-p13)
+CVE Name: CVE-2026-58092
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+mac_do(4) is a MAC policy module that allows unprivileged processes to
+switch credentials using setcred(2), subject to administrator-defined
+rules. Rules can restrict transitions based on the calling process'
+user and group identities.
+
+II. Problem Description
+
+In FreeBSD 15.0, the kernel structure used to represent user credentials
+changed: previously the primary group ID was stored in the first element
+of the array containing the list of supplementary group IDs, whereas now
+the primary group ID is stored in a dedicated field. This change was
+largely internal to the kernel and not user-visible.
+
+One function, group_is_primary(), was not properly updated as a part of
+this transition. This function is used by mac_do to determine the
+primary group ID of the credential after applying a transition rule,
+used when the rule target does not explicitly specify a group.
+
+As a result, with certain mac_do rules, it is possible for a credential
+switch to incorrectly set the primary group ID to the ID stored in the
+first element of the original credential's supplementary group array.
+If the list of supplementary groups is empty, this value will be 0,
+corresponding to the "wheel" group. For example, a rule such as
+"uid=1001>uid=1002" can be abused to set the primary group ID to 0 even
*** 4130 LINES SKIPPED ***