git: 052e5cb3d6 - main - Add EN-26:25 to EN-26:27 and SA-26:70 to SA-26:72
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 14 Oct 2026 17:56:57 UTC
The branch main has been updated by gordon:
URL: https://cgit.FreeBSD.org/doc/commit/?id=052e5cb3d663849d7139eb373ede09092c29a577
commit 052e5cb3d663849d7139eb373ede09092c29a577
Author: Gordon Tetlow <gordon@FreeBSD.org>
AuthorDate: 2026-10-14 17:56:07 +0000
Commit: Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2026-10-14 17:56:07 +0000
Add EN-26:25 to EN-26:27 and SA-26:70 to SA-26:72
---
website/data/security/advisories.toml | 12 +
website/data/security/errata.toml | 12 +
.../advisories/FreeBSD-EN-26:25.tzdata.asc | 168 +++++
.../security/advisories/FreeBSD-EN-26:26.hastd.asc | 195 ++++++
.../security/advisories/FreeBSD-EN-26:27.tcp.asc | 175 +++++
.../security/advisories/FreeBSD-SA-26:70.tcp.asc | 151 +++++
.../security/advisories/FreeBSD-SA-26:71.sound.asc | 158 +++++
.../security/advisories/FreeBSD-SA-26:72.bhyve.asc | 176 +++++
.../security/patches/EN-26:25/tzdata-2026e.patch | 332 ++++++++++
.../patches/EN-26:25/tzdata-2026e.patch.asc | 17 +
.../static/security/patches/EN-26:26/hastd.patch | 128 ++++
.../security/patches/EN-26:26/hastd.patch.asc | 17 +
website/static/security/patches/EN-26:27/tcp.patch | 11 +
.../static/security/patches/EN-26:27/tcp.patch.asc | 17 +
website/static/security/patches/SA-26:70/tcp.patch | 47 ++
.../static/security/patches/SA-26:70/tcp.patch.asc | 17 +
.../security/patches/SA-26:71/sound-14.patch | 720 ++++++++++++++++++++
.../security/patches/SA-26:71/sound-14.patch.asc | 17 +
.../security/patches/SA-26:71/sound-15.patch | 729 +++++++++++++++++++++
.../security/patches/SA-26:71/sound-15.patch.asc | 17 +
.../security/patches/SA-26:72/bhyve-14.patch | 685 +++++++++++++++++++
.../security/patches/SA-26:72/bhyve-14.patch.asc | 17 +
.../security/patches/SA-26:72/bhyve-15.patch | 686 +++++++++++++++++++
.../security/patches/SA-26:72/bhyve-15.patch.asc | 17 +
24 files changed, 4521 insertions(+)
diff --git a/website/data/security/advisories.toml b/website/data/security/advisories.toml
index 8a4204ed11..31ba77c237 100644
--- a/website/data/security/advisories.toml
+++ b/website/data/security/advisories.toml
@@ -1,6 +1,18 @@
# Sort advisories by year, month and day
# $FreeBSD$
+[[advisories]]
+name = "FreeBSD-SA-26:72.bhyve"
+date = "2026-10-14"
+
+[[advisories]]
+name = "FreeBSD-SA-26:71.sound"
+date = "2026-10-14"
+
+[[advisories]]
+name = "FreeBSD-SA-26:70.tcp"
+date = "2026-10-14"
+
[[advisories]]
name = "FreeBSD-SA-26:69.udp"
date = "2026-09-29"
diff --git a/website/data/security/errata.toml b/website/data/security/errata.toml
index cacb9261de..8fa363eaa5 100644
--- a/website/data/security/errata.toml
+++ b/website/data/security/errata.toml
@@ -1,6 +1,18 @@
# Sort errata notices by year, month and day
# $FreeBSD$
+[[notices]]
+name = "FreeBSD-EN-26:27.tcp"
+date = "2026-10-14"
+
+[[notices]]
+name = "FreeBSD-EN-26:26.hastd"
+date = "2026-10-14"
+
+[[notices]]
+name = "FreeBSD-EN-26:25.tzdata"
+date = "2026-10-14"
+
[[notices]]
name = "FreeBSD-EN-26:24.tzdata"
date = "2026-09-29"
diff --git a/website/static/security/advisories/FreeBSD-EN-26:25.tzdata.asc b/website/static/security/advisories/FreeBSD-EN-26:25.tzdata.asc
new file mode 100644
index 0000000000..0b9b366d5b
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:25.tzdata.asc
@@ -0,0 +1,168 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:25.tzdata Errata Notice
+ The FreeBSD Project
+
+Topic: Timezone database information update
+
+Category: contrib
+Module: zoneinfo
+Announced: 2026-10-14
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-10-03 06:56:13 UTC (stable/15, 15.1-STABLE)
+ 2026-10-14 16:04:29 UTC (releng/15.1, 15.1-RELEASE-p5)
+ 2026-10-03 07:59:46 UTC (stable/14, 14.5-STABLE)
+ 2026-10-14 16:04:05 UTC (releng/14.5, 14.5-RELEASE-p2)
+ 2026-10-14 16:03:47 UTC (releng/14.4, 14.4-RELEASE-p11)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+The IANA Time Zone Database (often called tz or zoneinfo) contains code and
+data that represent the history of local time for many representative
+locations around the globe. It is updated periodically to reflect changes
+made by political bodies to time zone boundaries, UTC offsets, and
+daylight-saving rules.
+
+FreeBSD releases install the IANA Time Zone Database in /usr/share/zoneinfo.
+The tzsetup(8) utility allows the user to specify the default local time
+zone. Based on the selected time zone, tzsetup(8) copies one of the files
+from /usr/share/zoneinfo to /etc/localtime. A time zone may also be selected
+for an individual process by setting its TZ environment variable to a desired
+time zone name.
+
+II. Problem Description
+
+Several changes to future and past timestamps have been recorded in the IANA
+Time Zone Database after previous FreeBSD releases were released. This
+affects many users in different parts of the world. Because of these
+changes, the data in the zoneinfo files need to be updated. If the local
+timezone on the running system is affected, tzsetup(8) needs to be run to
+update /etc/localtime.
+
+III. Impact
+
+An incorrect time will be displayed on a system configured to use one of the
+affected time zones if the /usr/share/zoneinfo and /etc/localtime files are
+not updated, and all applications on the system that rely on the system time,
+such as cron(8) and syslog(8), will be affected.
+
+IV. Workaround
+
+The system administrator can install an updated version of the IANA Time Zone
+Database from the misc/zoneinfo port and run tzsetup(8).
+
+Applications that store and display times in Coordinated Universal Time (UTC)
+are not affected.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date.
+
+Please note that some third party software, for instance PHP, Ruby, Java,
+Perl and Python, may be using different zoneinfo data sources, in such cases
+this software must be updated separately. Software packages that are
+installed via binary packages can be upgraded by executing 'pkg upgrade'.
+
+Following the instructions in this Errata Notice will only update the IANA
+Time Zone Database installed in /usr/share/zoneinfo.
+
+Perform one of the following:
+
+1) To update your system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+
+2) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-26:25/tzdata-2026e.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:25/tzdata-2026e.patch.asc
+# gpg --verify tzdata-2026e.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+Restart all the affected applications and daemons, or reboot the system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 961a842fdd3a stable/15-n285756
+releng/15.1/ 92af638d5ee7 releng/15.1-n283628
+stable/14/ 7b8c80572256 stable/14-n275286
+releng/14.5/ 672090209998 releng/14.5-n274885
+releng/14.4/ 24aef4c96a12 releng/14.4-n273779
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://github.com/eggert/tz/blob/2026e/NEWS>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:25.tzdata.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwckbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvxXQP/RBHlpRIZF+Djt9Lia47
+mENgVI08p5/rQzw6bT1EB8UlfYyeKU6azMCIEG8R1N8aAXf3aknls3ANpCI0IJ6W
+7LJoEmTH/DxOGAty5u5zNL/pRXc6wtNQCoF/YJgVIspctQ3qG92PDjc6hRXnPz6+
+JrVo/6T5VjMnYK73VXYzX2xlfRoUVU10zIruX5GwxBXWmcbIMgwSYvoJ9MkUBCDv
+FOtTfqVR+2tGlLlFCPacJjLVxapwItmF3+TPXYxGdTnJuMTujU3XCuL/RsUVwFLB
+8BD5z5hb4tEhILZvh3v4pTUkOiIlraDp+NDWujGLt8I+j+rKXoUsnVs2mvIzXr3E
+K2SjOFO54ePTyCDALk+SZe76z77fJTCWioRfvT+WWiRH4f/7CfozFt2femzsdYzG
+JB5BKQgBN4wjpcEH6t+NYn+pGC8fg03cFlcPVKEkPxbiCvNdIJlbY5dKi+D0OOF4
+7Ak/fhGT4VRF4qIKn0/K2hdEBTN5UIaVynwJ8KHXqwWDIKZ8ZaRmHXbbx9o3Xahx
+WE6ESkZ9DmcyK+jjODkb46MhBKYjBsrMyBKyIOFh6PWzp2OHyKlsa61qf/HJZNL3
+M3wqglYdcxvIBPi4qTrxwQk3VhEXR95MjXr10x00WJWnNFpMbLv/3Ey7ABE2G3mK
+cy+wB3o/QeR6+6n7XRUi65F/
+=Fnl8
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-26:26.hastd.asc b/website/static/security/advisories/FreeBSD-EN-26:26.hastd.asc
new file mode 100644
index 0000000000..1df6113479
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:26.hastd.asc
@@ -0,0 +1,195 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:26.hastd Errata Notice
+ The FreeBSD Project
+
+Topic: Multiple issues in hastd(8)
+
+Category: core
+Module: hastd
+Announced: 2026-10-14
+Credits: Alessandro Sagratini, Martin Vidovic, Glen Barber
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-09-20 17:07:37 UTC (stable/15, 15.1-STABLE)
+ 2026-10-14 16:04:32 UTC (releng/15.1, 15.1-RELEASE-p5)
+ 2026-09-20 17:07:56 UTC (stable/14, 14.5-STABLE)
+ 2026-10-14 16:04:08 UTC (releng/14.5, 14.5-RELEASE-p2)
+ 2026-10-14 16:03:50 UTC (releng/14.4, 14.4-RELEASE-p11)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+hastd(8) allows transparent replication of a block of storage (the
+resource) between a pair of systems connected over a TCP/IP network.
+At any given time, only one system (the primary node) can access the
+resource. Writes performed on the primary node are continuously
+transmitted to the other system (the secondary node).
+
+hastctl(8) is a command-line program used to control a hastd(8)
+instance on the same machine.
+
+II. Problem Description
+
+All communication between hastd nodes, between hastd and hastctl, and
+between the main hastd process and its child processes relies on a
+shared set of networking routines and an early implementation of
+name-value pair lists similar to but distinct from libnv(3), which was
+a later development.
+
+1. Control messages between hastd and hastctl can be empty, consisting
+ solely of a header with no payload. However, after receiving the
+ header, the function used to receive control messages asserts that
+ buffer space for the payload was successfully allocated. When
+ there is no payload, this assertion fails.
+
+2. The nvpair implementation used by hastd and hastctl pads names and
+ values out to multiples of eight bytes, but does not initialize the
+ padding. As a result, small amounts of data from reused heap
+ allocations can find their way into that padding.
+
+3. The main hastd process uses local domain sockets to communicate
+ with its workers. When the main hastd process hands off an
+ incoming connection to a worker, it first sends a variable-length
+ string indicating the type of socket. The child receives this
+ message using a function which does not allow short reads. This
+ previously worked due to a bug in the local domain socket code
+ which forced a short read if a normal message was followed by one
+ that passed a descriptor.
+
+III. Impact
+
+1. Depending on the exact configuration, certain hastctl commands may
+ result in an empty response from hastd, causing hastctl to print an
+ error message and abort. This does not affect the operation of
+ hastd itself, but may make it difficult to inquire into its status
+ or change its mode of operation.
+
+2. The most obvious symptom of the padding issue is that small amounts
+ of text from the configuration file end up embedded in the metadata
+ at the start of the backing store for a HAST resource, because the
+ memory that was first used to read the configuration is later
+ reused to assemble the metadata before writing it out.
+
+ Small amounts of hastd memory, potentially including data
+ previously written to the resource, may also end up embedded in
+ network messages passed between hastd nodes.
+
+3. As a pair of HAST nodes transition from initialization to
+ operation, the primary node will attempt to establish a network
+ connection to the secondary node. The secondary node accepts the
+ connection, then hands the socket off to a worker child. The
+ worker child then hangs forever trying to read the socket type,
+ preventing the node from transitioning to secondary. The pair
+ remains forever in degraded mode, where the primary is able to
+ operate normally but no replication to the secondary occurs.
+
+IV. Workaround
+
+No workaround is available, but systems that do not use hastd(8) are not
+affected.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date. Restart hastd(8), or
+reboot the system.
+
+Perform one of the following:
+
+1) To update your system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+
+2) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-26:26/hastd.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:26/hastd.patch.asc
+# gpg --verify hastd.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+Restart hastd(8), or reboot the system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ cd8eef45d2d0 stable/15-n285597
+releng/15.1/ c8fe55b4726a releng/15.1-n283631
+stable/14/ 9401bfb06108 stable/14-n275205
+releng/14.5/ 49baaf01c26a releng/14.5-n274888
+releng/14.4/ 1c821dc49b53 releng/14.4-n273782
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://bugs.freebsd.org/292322>
+<URL:https://bugs.freebsd.org/298085>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:26.hastd.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwdUbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvNkMP/1iZxLmeolrPLftdjdBr
+NKTK4/EYKQupuCKhuGrJKRIbDcuz3aKoU+0lO821ra0ktly1mdzuO7xrNXIhzH6J
+nTg+8MTPpM943sR2HP5vIyGPE+sXFd+YpSWjA0UHBhWIE25BFADhV0BC1UK1pGlD
+nLYO/3eaPtmNAoP0UUo/YD/92JaoG2piqkPFYmPOVdbMwY3uphNzwhilJCuBdCMs
+yxqhO/dpU+TYgv0vXs02p7iBvxwVHqgbZGHZHHBg+xnXBeFpMOXQ2jrtUJVc1FKZ
+gVaHEoC0zO6VRg0pXCKU+SCYCvH0jlVGu/rBcpHgxTREN0Uf95lmO0NBWS5WgfBa
+bl9mP3kwXc/rW59y36tY8vMTjg28J0h4DdTgPy2iJVcrYPWFx+ufUyVIdGCiuZat
+Y3AjHwS/tPBAH15ovUBtkF1l7vB/LLRAi0qODnQmhgVkeZX2/PjGtzftyOES9P1T
+zhehQnl1Twe+JiJgdtei/6UrnYHv2NKdmoW74tdi5WYizbnatN0P6uMLSCKdfbsZ
+7q2i/8GUY4Js1yDqDAWGbg5fpq8fAKSY1GJtebK83E9MVjLaIl87llgS1KQASpXi
+gmW4h9L8ZKZJPcysUk2YgXEDgMRKvuyj2soNVyL1V4oZtCJ4Tga4pdnjcyJlwpUT
+JlT5dlSJCp7ed7hNh4wgOTTo
+=kksa
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-26:27.tcp.asc b/website/static/security/advisories/FreeBSD-EN-26:27.tcp.asc
new file mode 100644
index 0000000000..cd4f59c15a
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:27.tcp.asc
@@ -0,0 +1,175 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:27.tcp Errata Notice
+ The FreeBSD Project
+
+Topic: TCP timers may overflow and fire late or not at all
+
+Category: core
+Module: tcp
+Announced: 2026-10-14
+Credits: Lukas Book
+Affects: FreeBSD 15.1 and 14.4
+Corrected: 2026-08-06 09:07:02 UTC (stable/15, 15.1-STABLE)
+ 2026-10-14 16:04:33 UTC (releng/15.1, 15.1-RELEASE-p5)
+ 2026-08-06 05:55:09 UTC (stable/14, 14.5-PRERELEASE)
+ 2026-10-14 16:03:51 UTC (releng/14.4, 14.4-RELEASE-p11)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+Each TCP connection maintains a set of timers, covering retransmission,
+persist, keepalive, 2MSL (TIME_WAIT and FIN_WAIT_2), and delayed ACK.
+Since FreeBSD 14.0, the default TCP stack multiplexes all of these timers
+onto a single callout(9) per connection. Whenever a timer is started or
+stopped, the stack selects the earliest pending timer, together with the
+allowed scheduling precision, and reschedules the callout accordingly.
+
+A stopped timer is marked by setting its expiry time to SBT_MAX.
+
+II. Problem Description
+
+When a timer was stopped, its previously computed precision was left in
+place. While selecting the next timer to schedule, the stack added that
+precision to the SBT_MAX expiry of the stopped timer, causing a signed
+integer overflow. The resulting negative value was then used to compute
+the precision passed to callout(9) for the connection's callout.
+
+III. Impact
+
+The per-connection callout may be scheduled with an invalid precision,
+causing TCP timers to run far later than intended. Affected connections
+may fail to retransmit, send keepalives, or leave TIME_WAIT and FIN_WAIT_2
+in a timely manner, and can remain in the connection table indefinitely,
+consuming memory, protocol control blocks, and local ports.
+
+Affected connections can be recognized by negative or implausibly large
+values in the timer columns (rexmt, persist, keep, 2msl, delack) reported
+by "netstat -nxptcp".
+
+Only connections using the default FreeBSD TCP stack are affected.
+
+IV. Workaround
+
+Affected connections can be listed with netstat(1) and terminated with
+tcpdrop(8). The following prints the local and foreign endpoints of all
+connections with a negative value in any of the rexmt, persist, keep,
+2msl, or delack timer columns:
+
+# netstat -nxptcp | \
+ awk 'NR > 2 && ($14 < 0 || $15 < 0 || $16 < 0 || $17 < 0 || $18 < 0) \
+ { print $4, $5 }'
+
+Review the output, then drop each connection by passing the two endpoints
+exactly as printed to tcpdrop(8), which accepts the netstat(1) address
+format directly, for example:
+
+# tcpdrop 192.0.2.1.80 198.51.100.7.53211
+
+Note that connections whose timers have been deferred without becoming
+negative are not detected by this method, and that dropping a connection
+resets it for the peer.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date, and reboot the system.
+
+Perform one of the following:
+
+1) To update your system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for an erratum fix"
+
+2) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for an erratum fix"
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-26:27/tcp.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:27/tcp.patch.asc
+# gpg --verify tcp.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ e8d1cee43741 stable/15-n284741
+releng/15.1/ cf95af02eb15 releng/15.1-n283632
+stable/14/ 85485a570d4f stable/14-n274777
+releng/14.4/ 11f0c61eecb8 releng/14.4-n273783
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://reviews.freebsd.org/D58484>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:27.tcp.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwdcbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvwe8P/jP7gDz4gtYvhzd4W2v2
+v02GxryG8zdoHTRdNh2T4ZGXrg1vLRCuINZazJWtZKXpWHTnFXluUXimpB6Gk8oP
+yBix+d/vgdB7H4OWkSn9PFqEcTtLDLxdLgVdyfYjugqG3hKE86op724sujWbcyKg
+mKjZNyk29NqXrH0gGiU/KzOI6iwHmsxJMeglk4Yw7z4cFf+NNslhZlKnH241aI1x
+SCTwm6vT8mdFc6h6vHQ77IMnNCzsGY8/BN3OtcCaFijB4gU/VsplwiZC3r+cUmnF
+aZLeabLGcmT1xemR4nDssI+qAc9+f6fuEi/enWoZFH6ZA8OFq6YubR9vjBQeslGW
+EApxRD/HoURuSwZCKwET7B6CZSWVeuGQya8bG86PbXDjAXQUhI7kG4LTFAkHAqoq
+zllJYxmKvBU3fZnJrcbVGD/39cMZ9XZYfEOfCrHMpCU0z+H2F7Q0TP88xRecbVsE
+0Khk3CA8hdqHn7qKzgNHrGJ8jwNGZ8ms9+QIXtUeirSQGBK1gOwNFyf2ehwmo8S1
+kb6FjcanX50PIJGKV3XMtyUBQFuBKxNxI/L/wjUUgCwcMTM8WEGjrTECO1O2+1ZX
+xhKf4WmiMy8cyoIqmCyzdcKtHYegVzpqr1XWjasYunAmKcyJVeQV02VBlB5TDc3I
+TIuOY6BPvFsN/4AOoY7eo0vy
+=Fmg2
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:70.tcp.asc b/website/static/security/advisories/FreeBSD-SA-26:70.tcp.asc
new file mode 100644
index 0000000000..2b9238dfec
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:70.tcp.asc
@@ -0,0 +1,151 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:70.tcp Security Advisory
+ The FreeBSD Project
+
+Topic: Remotely triggerable buffer overflow in tcp_rack
+
+Category: core
+Module: tcp_rack
+Announced: 2026-10-14
+Credits: Raffaele Bova at Nozomi Networks Security Research
+Affects: FreeBSD 15.1
+Corrected: 2026-10-14 16:02:55 UTC (stable/15, 15.1-STABLE)
+ 2026-10-14 16:04:34 UTC (releng/15.1, 15.1-RELEASE-p5)
+CVE Name: CVE-2026-101307
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+FreeBSD supports multiple pluggable TCP stacks. The RACK stack
+implements the Recent ACKnowledgment (RACK) loss detection algorithm
+and is provided as the loadable kernel module tcp_rack.ko. The RACK
+stack includes a path capacity measurement (PCM) module that records
+per-ACK samples in a dynamically growing array.
+
+II. Problem Description
+
+When the PCM sample array needs to grow, the RACK stack doubles a
+16-bit allocation counter. Repeated doublings caused the counter to
+wrap to zero, resulting in a near-zero-length allocation followed by a
+copy of the existing samples into the undersized buffer. A remote
+peer can trigger the expansion by sending a sufficient number of ACKs
+on an established connection.
+
+III. Impact
+
+A remote attacker who can establish a TCP connection to a system using the
+RACK stack can trigger an out-of-bounds write of approximately 512 KB in
+the kernel heap possibly resulting in a kernel panic.
+
+IV. Workaround
+
+Systems that have not loaded the tcp_rack.ko kernel module are not
+affected. To check whether it is loaded, run:
+
+# kldstat -m tcp_rack
+
+The tcpsso(8) utility can be used to migrate existing TCP connections
+to a different TCP stack.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/SA-26:70/tcp.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:70/tcp.patch.asc
+# gpg --verify tcp.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 57818a298ee1 stable/15-n286003
+releng/15.1/ 5dd20a06fe9e releng/15.1-n283633
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-101307>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:70.tcp.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwdkbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvxDcQANjx497pJcMBMEkbXX2y
+GgWhda1BNnenRPuIzZGREXGrP/XvcWCe55lIqE5yf2j5OoDNLm8+N5bog8l/qawd
+oK/M8FUdsoRawyr3PClHKinHYYhaHsLneih9RHeTbQEcyTHCyE+lbfOiE0+mMit3
+I6F2Mj5K4m0bcCTyj52bjg+GgSZp0SWAlaEvg0FFBx5vAzql6BDPsPAO5Hz+3XmA
+5OXz0feVLmAA9wqY/H8GVnZcK37ty80KAj/vNPpSiHFBimcl9GxyincukggpU0fH
+si9G1aAgik6lyQtv78J1n/roLKajBr43isEeKRi10LgYTlUy8w6Qd/acCU20EDay
+9Ent9TJizJp8RkTsygooAMZS+gq2jowBiOXqpEfFzQq1fk/T77QavE082yOSkXy8
+x8NXk3QVH6A7Fmbse2At/pVvcIboJyBQrqWy6GPZibf20Q5Uv1mU/5yx7nd0vNW9
+JGFNhgQybTTrGpm10C/HReuMchtEgduFnxZVQLCF9+5egg9sBrhXcHuo5KQgYJIy
+UJDgEcvntvOKQiySZVMf0ICMsluSzLXqULX9RdpYlNJMM/4I3KRzW36tcgDQPAhn
+rS4waz3LAThxbMHLrZBx9TlblpXKRWlbXJt2hjQnpS/4gpMEt9NfQmiihQDoBnWm
+121Qq1WcQ6FEumRgnwN9jAZT
+=9SEJ
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:71.sound.asc b/website/static/security/advisories/FreeBSD-SA-26:71.sound.asc
new file mode 100644
index 0000000000..568967de0b
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:71.sound.asc
@@ -0,0 +1,158 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:71.sound Security Advisory
+ The FreeBSD Project
+
+Topic: TOCTOU race between sound(4) buffer resizing and mmap
+
+Category: core
+Module: sound
+Announced: 2026-10-14
+Credits: Hazley Samsudin of GovTech CSG
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-10-14 16:02:57 UTC (stable/15, 15.1-STABLE)
+ 2026-10-14 16:04:37 UTC (releng/15.1, 15.1-RELEASE-p5)
+ 2026-10-14 16:03:13 UTC (stable/14, 14.5-STABLE)
+ 2026-10-14 16:04:10 UTC (releng/14.5, 14.5-RELEASE-p2)
+ 2026-10-14 16:03:54 UTC (releng/14.4, 14.4-RELEASE-p11)
+CVE Name: CVE-2026-101308
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+FreeBSD provides audio support through the sound(4) driver, which
+presents each audio device as a set of character device nodes such as
+/dev/dsp.
+
+Applications can map a channel buffer via mmap(2) for low-latency audio
+I/O.
+
+II. Problem Description
+
+When an audio channel's buffer needs to be resized, the sound(4)
+driver checks that the buffer is not memory-mapped and then drops the
+channel lock to allocate a new buffer. An mmap(2) call on another
+thread can complete during this window, after which the resize path
+frees the now-mapped buffer without rechecking.
+
+III. Impact
+
+An unprivileged local user with access to a sound device can exploit
+this race to trigger a use-after-free in the kernel, potentially
+escalating privileges.
+
+IV. Workaround
+
+No workaround is available. Systems with no sound devices are
+unaffected.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+[FreeBSD 15.x]
+# fetch https://security.FreeBSD.org/patches/SA-26:71/sound-15.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:71/sound-15.patch.asc
+# gpg --verify sound-15.patch.asc
+
+[FreeBSD 14.x]
+# fetch https://security.FreeBSD.org/patches/SA-26:71/sound-14.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:71/sound-14.patch.asc
+# gpg --verify sound-14.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 07eacba075ab stable/15-n286005
+releng/15.1/ 908bde55f070 releng/15.1-n283635
+stable/14/ d3b8957e2a82 stable/14-n275352
+releng/14.5/ 658b24eba235 releng/14.5-n274890
+releng/14.4/ ea6ecd1e3762 releng/14.4-n273785
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-101308>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:71.sound.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwdwbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvFyAQANMAY+KVmy+8+f7SBmeM
+scQrDyBXDF896i+sq3eaHDcx+gxrbQIIXWsO2oJ1fZOL15E1e/rSZGINWp/WzM3z
+xuUBaes3y84cTF0t7qOvDLCaYY/cWLcQzi0M6e/neCIlWYRLySQZtoBLW0JEBAa+
+l+wkzvkNFwYXF+RchcdmHTXA9EXfOZWeb2dg97L5EPmI6LXbk7HgEEONoZQLNx+Q
+xVPbrXi5GMzwo+yurJ+FF1AMlQyIiWsxNy3qK4iNLMhrfc/Z3HSm4CvN1bVAVrMZ
+LpRNVKVcb6eyMI7A9a3SDeDsqaQ0CiFpasHwKyCHqANoI99Kd2qzKddZLxkK6Pqp
+yUH6+pBclL86jXatSN0oa27veNMe6KMXS0MqCBKnP8y1hsIsvJ6Omhh+a/70aPOu
+ZjhWmr1mHMST5wpqXc9yk82iESICYqxtTIbGzt3NSbjOkuwxrdGnNvJfGLPIfYZn
+EhVD/3yBeVbn8HHDA3p03Q/DJYcWm0sN2A7YLjX+ES/tRVKoJXHnupI6ljc5WQj9
+LJx2jfs9ZJsjxlPksv5QxQmucCyylnBln75U85b6KnhQZH1I7akpimKvq8kM0X9C
+5naxSM8P7T0mknElixq8JXf9kjFPEPI00jYqWhP6TGBiUYug48Mk0029mP52vyU0
+SjKRu8UgqGFb94uCbEMoi+QC
+=ss5e
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:72.bhyve.asc b/website/static/security/advisories/FreeBSD-SA-26:72.bhyve.asc
new file mode 100644
index 0000000000..46dfa7644e
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:72.bhyve.asc
@@ -0,0 +1,176 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:72.bhyve Security Advisory
+ The FreeBSD Project
+
+Topic: Multiple vulnerabilities in bhyve device models
+
+Category: core
+Module: bhyve
+Announced: 2026-10-14
+Credits: Brian Delgado from Intel using Anthropic Opus 4.8
+Credits: Claude and Ada Logics
+Credits: Joshua Rogers of AISLE Research Team
+Credits: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
+ and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-10-14 16:03:00 UTC (stable/15, 15.1-STABLE)
+ 2026-10-14 16:04:40 UTC (releng/15.1, 15.1-RELEASE-p5)
*** 3726 LINES SKIPPED ***