git: 1e8ead4fd5 - main - Add EN-26:22 to EN-26:24 and SA-26:64 to SA-26:69.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 29 Sep 2026 19:12:00 UTC
The branch main has been updated by gordon:
URL: https://cgit.FreeBSD.org/doc/commit/?id=1e8ead4fd5d0545fcfd25fa0b5d1e75989f935db
commit 1e8ead4fd5d0545fcfd25fa0b5d1e75989f935db
Author: Gordon Tetlow <gordon@FreeBSD.org>
AuthorDate: 2026-09-29 19:11:10 +0000
Commit: Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2026-09-29 19:11:10 +0000
Add EN-26:22 to EN-26:24 and SA-26:64 to SA-26:69.
Approved by: so
---
website/data/security/advisories.toml | 24 +
website/data/security/errata.toml | 12 +
.../security/advisories/FreeBSD-EN-26:22.usb.asc | 130 +++
.../advisories/FreeBSD-EN-26:23.syslogd.asc | 139 ++++
.../advisories/FreeBSD-EN-26:24.tzdata.asc | 169 ++++
.../advisories/FreeBSD-SA-26:64.sysvsem.asc | 158 ++++
.../advisories/FreeBSD-SA-26:65.kqueue.asc | 153 ++++
.../security/advisories/FreeBSD-SA-26:66.jail.asc | 184 +++++
.../security/advisories/FreeBSD-SA-26:67.ktls.asc | 154 ++++
.../advisories/FreeBSD-SA-26:68.openssl.asc | 173 ++++
.../security/advisories/FreeBSD-SA-26:69.udp.asc | 152 ++++
website/static/security/patches/EN-26:22/usb.patch | 69 ++
.../static/security/patches/EN-26:22/usb.patch.asc | 17 +
.../static/security/patches/EN-26:23/syslogd.patch | 69 ++
.../security/patches/EN-26:23/syslogd.patch.asc | 17 +
.../security/patches/EN-26:24/tzdata-2026d.patch | 916 +++++++++++++++++++++
.../patches/EN-26:24/tzdata-2026d.patch.asc | 17 +
.../static/security/patches/SA-26:64/sysvsem.patch | 238 ++++++
.../security/patches/SA-26:64/sysvsem.patch.asc | 17 +
.../static/security/patches/SA-26:65/kqueue.patch | 33 +
.../security/patches/SA-26:65/kqueue.patch.asc | 17 +
.../security/patches/SA-26:66/jail-14.4.patch | 699 ++++++++++++++++
.../security/patches/SA-26:66/jail-14.4.patch.asc | 17 +
.../security/patches/SA-26:66/jail-14.5.patch | 598 ++++++++++++++
.../security/patches/SA-26:66/jail-14.5.patch.asc | 17 +
.../security/patches/SA-26:66/jail-15.0.patch | 661 +++++++++++++++
.../security/patches/SA-26:66/jail-15.0.patch.asc | 17 +
.../security/patches/SA-26:66/jail-15.1.patch | 661 +++++++++++++++
.../security/patches/SA-26:66/jail-15.1.patch.asc | 17 +
.../static/security/patches/SA-26:67/ktls.patch | 384 +++++++++
.../security/patches/SA-26:67/ktls.patch.asc | 17 +
.../security/patches/SA-26:68/openssl-14.patch | 37 +
.../security/patches/SA-26:68/openssl-14.patch.asc | 17 +
.../security/patches/SA-26:68/openssl-15.patch | 476 +++++++++++
.../security/patches/SA-26:68/openssl-15.patch.asc | 17 +
website/static/security/patches/SA-26:69/udp.patch | 13 +
.../static/security/patches/SA-26:69/udp.patch.asc | 17 +
37 files changed, 6523 insertions(+)
diff --git a/website/data/security/advisories.toml b/website/data/security/advisories.toml
index 04564bc272..8a4204ed11 100644
--- a/website/data/security/advisories.toml
+++ b/website/data/security/advisories.toml
@@ -1,6 +1,30 @@
# Sort advisories by year, month and day
# $FreeBSD$
+[[advisories]]
+name = "FreeBSD-SA-26:69.udp"
+date = "2026-09-29"
+
+[[advisories]]
+name = "FreeBSD-SA-26:68.openssl"
+date = "2026-09-29"
+
+[[advisories]]
+name = "FreeBSD-SA-26:67.ktls"
+date = "2026-09-29"
+
+[[advisories]]
+name = "FreeBSD-SA-26:66.jail"
+date = "2026-09-29"
+
+[[advisories]]
+name = "FreeBSD-SA-26:65.kqueue"
+date = "2026-09-29"
+
+[[advisories]]
+name = "FreeBSD-SA-26:64.sysvsem"
+date = "2026-09-29"
+
[[advisories]]
name = "FreeBSD-SA-26:63.posixshm"
date = "2026-08-25"
diff --git a/website/data/security/errata.toml b/website/data/security/errata.toml
index 95f39afe6f..cacb9261de 100644
--- a/website/data/security/errata.toml
+++ b/website/data/security/errata.toml
@@ -1,6 +1,18 @@
# Sort errata notices by year, month and day
# $FreeBSD$
+[[notices]]
+name = "FreeBSD-EN-26:24.tzdata"
+date = "2026-09-29"
+
+[[notices]]
+name = "FreeBSD-EN-26:23.syslogd"
+date = "2026-09-29"
+
+[[notices]]
+name = "FreeBSD-EN-26:22.usb"
+date = "2026-09-29"
+
[[notices]]
name = "FreeBSD-EN-26:21.openssl"
date = "2026-08-25"
diff --git a/website/static/security/advisories/FreeBSD-EN-26:22.usb.asc b/website/static/security/advisories/FreeBSD-EN-26:22.usb.asc
new file mode 100644
index 0000000000..7540d882ea
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:22.usb.asc
@@ -0,0 +1,130 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:22.usb Errata Notice
+ The FreeBSD Project
+
+Topic: umass(4) devices may fail to attach
+
+Category: core
+Module: usb
+Announced: 2026-09-29
+Affects: FreeBSD 14.5
+Corrected: 2026-09-04 17:56:23 UTC (stable/14, 14.5-STABLE)
+ 2026-09-29 16:09:02 UTC (releng/14.5, 14.5-RELEASE-p1)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+The USB mass storage driver, umass(4), provides support for various models
+of thumb drives, hard drives, and other media devices that may be attached
+over USB through an xhci(4) controller.
+
+II. Problem Description
+
+The umass(4) driver relies on the ability to reset the USB data toggle
+during normal operation. A change to xhci(4) intended to keep the data
+toggle state synchronized with the connected device inadvertently prevented
+device drivers from resetting it.
+
+III. Impact
+
+Some umass(4) devices may fail to attach as a result of this change. One
+such failure may be surfaced via a bad CAM status, such as:
+
+(da8:umass-sim0:0:0:0): got CAM status 0x444
+(da8:umass-sim0:0:0:0): fatal error, failed to attach to device
+
+IV. Workaround
+
+No workaround is available.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date, and reboot the system.
+
+Perform one of the following:
+
+1) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r now
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-26:22/usb.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:22/usb.patch.asc
+# gpg --verify usb.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ f656bde0c2ef stable/14-n275115
+releng/14.5/ 662ed9948327 releng/14.5-n274873
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:22.usb.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmq8DKQbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvtFEP/R2dZTqA9XizofMWKmov
+818VRbgNFSZIhDy+94jhyJ2DBuLpF8wZ6PQM8ClrtVihdSUHV59s2iVra1lQcGys
+D1Pq6Tm+05OiBa7RdGr7v3sNE6u4FbB5shfQ93+YrL2cXs/D/3EAH+e3cXHnSghd
+AP2Ftaenj85/cOf7RzxRvPP/5OD7VeR0L9NgY/Y+uiPTTRGA8nEKT9/huEnhjmsD
+/pBL+G/QsV8xl0zeyciHmX6Pb77W2PNLcz9ccOPlLat5kvkpRldtnRYm49OSWCSn
+0kyHANtSgbrFtU7tdUpSeWRJ5JZN/tRMcHehdzCRF0r4g4/wwHeR4egVCVLvicjN
+lMcTSpBBGO4LQXvj6icUMiDVGDSZ9Gi3Cy6QZd8ns+79ywgHqRxRIyww+NGzDTZy
+JKIIFK5UwmTV0aKpJu6M0hu6srfb+Z7tZX4iTRQ2bi6xylRV20w3T7o6r9O23Ajv
+hSz6cGWtrGikskDuPr60iQSkJFNTk7Nax02Frk1vKnk5NPilnCCpDmGqKDicnRhg
++LmjnrGYJ/KoFmneSXgX1mfBN5QWNvH8TNquBOe3usc96angQ+u0ZaT4PoGu5oNL
+eVdElGbUQiIVpinZs0ZYuti7qNVC7fVSp9Zw42l2MH6CTSJqomN0+YCwqKyBlth0
+yhESsi8P+Bv19lziNHQswgF6
+=MAAG
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-26:23.syslogd.asc b/website/static/security/advisories/FreeBSD-EN-26:23.syslogd.asc
new file mode 100644
index 0000000000..74c82676c3
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:23.syslogd.asc
@@ -0,0 +1,139 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:23.syslogd Errata Notice
+ The FreeBSD Project
+
+Topic: syslogd(8) leaks child processes when logging to a pipe
+
+Category: core
+Module: syslogd
+Announced: 2026-09-29
+Affects: FreeBSD 15.1
+Corrected: 2026-09-09 08:35:26 UTC (stable/15, 15.1-STABLE)
+ 2026-09-29 15:59:59 UTC (releng/15.1, 15.1-RELEASE-p4)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+syslogd(8) is the system log daemon. It reads log messages from the
+kernel and from processes, and distributes them to destinations defined
+in syslog.conf(5). One supported destination is an external program,
+specified with a leading '|' character, to which syslogd(8) pipes log
+messages on its standard input.
+
+II. Problem Description
+
+When syslogd(8) reloaded its configuration on receipt of SIGHUP, as
+typically happens during log rotation, it could leak the process
+descriptor for the program at the other end of a pipe destination.
+
+III. Impact
+
+Each configuration reload may leave behind zombie processes that are never
+reaped. syslogd(8) may also crash when one of these processes exits.
+
+IV. Workaround
+
+No workaround is available. Systems not using pipe destinations in
+syslog.conf(5) are not affected.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date.
+
+Perform one of the following:
+
+1) To update your system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# service syslogd restart
+
+2) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# service syslogd restart
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-26:23/syslogd.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:23/syslogd.patch.asc
+# gpg --verify syslogd.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+Restart the applicable daemons, or reboot the system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 74c5995d2e8d stable/15-n285422
+releng/15.1/ a64d17f24c43 releng/15.1-n283613
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:23.syslogd.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmq8DK0bFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvodEQANWmJm4z1aOCe68emirl
+1U213rspn7ni4cyKyXezyuNuePWqG16Frlqwc8yN4kblX+odWOeLk0qPGUtxeI1w
+psOQbLhUL1rgmddqxcXnMseD0+p4hxDK8Y3jUhnrK1jQlIN8BD/b9GHUtLp+ZgKQ
+P5X1FL+adNj/wvf3ex3JWisC33F7XB1xIGLuHZlHt5Kcx7Rmmp8aqVDhFjR42fht
+MRC7AA+gxuGn/+eaVPyLB6ow+gIh8X0ju/PgyH06HF7Z0MbhjUTxsafzLqa9XbQ9
+kBVATcd8SlW/5Ltj45/6ASbHzw5VxXYqOpPfvVEuF+UiSldqLSkeLkn/mXrlwt3g
+4OyTWocfIrcqH3tKpQpdzsjmCU7jVCBPNN3uIcxSsNy4fOA5de201hlKqty2ex7T
+Jncn4nMWJLemhNEdwWZ+WkxwblXi8hcJ3+r940T7fzTNf0J8QfIL9V2oXlvB4KZM
+06Xbz2gdu7vevy1kqGdZIVjpiYfxN0bWxrk7tITONZldcO8/9kz5se6aOG3Yjkcq
+UOGGG/M0m6dC0YUxUcan1puaDyDa1r52uv6H/zVNrptTnL8YI/zIjkwvzkA5gC8I
+o2OY7r3wwyIbC9OCIphntd/b/d7vUEaFqn1Y/zR4L5uiVnsEGQ0MZDWNX7LCWMrQ
+04HXfjagZcKPRUixPuSdtQYw
+=FMsL
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-26:24.tzdata.asc b/website/static/security/advisories/FreeBSD-EN-26:24.tzdata.asc
new file mode 100644
index 0000000000..bdd69e3d69
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-26:24.tzdata.asc
@@ -0,0 +1,169 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-26:24.tzdata Errata Notice
+ The FreeBSD Project
+
+Topic: Timezone database information update
+
+Category: contrib
+Module: zoneinfo
+Announced: 2026-09-29
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-09-15 00:51:29 UTC (stable/15, 15.1-STABLE)
+ 2026-09-29 16:00:01 UTC (releng/15.1, 15.1-RELEASE-p4)
+ 2026-09-29 15:59:11 UTC (releng/15.0, 15.0-RELEASE-p14)
+ 2026-09-15 03:47:39 UTC (stable/14, 14.5-STABLE)
+ 2026-09-29 16:09:03 UTC (releng/14.5, 14.5-RELEASE-p1)
+ 2026-09-29 15:57:25 UTC (releng/14.4, 14.4-RELEASE-p10)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security branches,
+and the following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+The IANA Time Zone Database (often called tz or zoneinfo) contains code and
+data that represent the history of local time for many representative
+locations around the globe. It is updated periodically to reflect changes
+made by political bodies to time zone boundaries, UTC offsets, and
+daylight-saving rules.
+
+FreeBSD releases install the IANA Time Zone Database in /usr/share/zoneinfo.
+The tzsetup(8) utility allows the user to specify the default local time
+zone. Based on the selected time zone, tzsetup(8) copies one of the files
+from /usr/share/zoneinfo to /etc/localtime. A time zone may also be selected
+for an individual process by setting its TZ environment variable to a desired
+time zone name.
+
+II. Problem Description
+
+Several changes to future and past timestamps have been recorded in the IANA
+Time Zone Database after previous FreeBSD releases were released. This
+affects many users in different parts of the world. Because of these
+changes, the data in the zoneinfo files need to be updated. If the local
+timezone on the running system is affected, tzsetup(8) needs to be run to
+update /etc/localtime.
+
+III. Impact
+
+An incorrect time will be displayed on a system configured to use one of the
+affected time zones if the /usr/share/zoneinfo and /etc/localtime files are
+not updated, and all applications on the system that rely on the system time,
+such as cron(8) and syslog(8), will be affected.
+
+IV. Workaround
+
+The system administrator can install an updated version of the IANA Time Zone
+Database from the misc/zoneinfo port and run tzsetup(8).
+
+Applications that store and display times in Coordinated Universal Time (UTC)
+are not affected.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date.
+
+Please note that some third party software, for instance PHP, Ruby, Java,
+Perl and Python, may be using different zoneinfo data sources, in such cases
+this software must be updated separately. Software packages that are
+installed via binary packages can be upgraded by executing 'pkg upgrade'.
+
+Following the instructions in this Errata Notice will only update the IANA
+Time Zone Database installed in /usr/share/zoneinfo.
+
+Perform one of the following:
+
+1) To update your system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+
+2) To update your system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-26:24/tzdata-2026d.patch
+# fetch https://security.FreeBSD.org/patches/EN-26:24/tzdata-2026d.patch.asc
+# gpg --verify tzdata-2026d.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+Restart all the affected applications and daemons, or reboot the system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 25985322095d stable/15-n285492
+releng/15.1/ 5c05c5f46689 releng/15.1-n283614
+releng/15.0/ e21386061b0e releng/15.0-n281115
+stable/14/ 7fa0ed470f72 stable/14-n275193
+releng/14.5/ 50231e5b9101 releng/14.5-n274874
+releng/14.4/ b38d9c709d73 releng/14.4-n273767
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://github.com/eggert/tz/blob/2026d/NEWS>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:24.tzdata.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmq8DK8bFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvfWQP/ibhDeKbJ2sGwlbYez1R
+P5S3LASvpQp7DMAb4Hn9u1PZ+XEEHLHXTKvh7QTylDPbJiYa9Uv6J3IBn2UT0Jzc
+WxKLoq1tcRzStOIkzRO3W/pKNt/DoMmFZFGSd9ioqiwxMlGPfK100qL1DY9sBn4L
+LQlYALIpHvBS77V8DwjqHwam8LElCHTBAVz8xMrAQExtq7gPUK/HzWnnuZY8yd2C
+zJxicCviIUpWZJJcIpOKNxm8Z0dD1Ghv9gG7obsfCitSxl53BHc77IzOKkgOeBBo
+iWXTYveygu2/KC75Pdecs2jvemjYfg4S/9OEx82SwPGXu0vLtF00OHW8bADpYZzn
+FwmZdoWvwhkcGJS7tocaXVYSBFaaCqNO47JeihrM5HAaTIxPtTCQonpECCEEnyEF
+YHo++unOXBk32WFJ1uGTLwoHTB3QvXbDl7MM/L0vZK3HcyGOTkZ7Ht+U2fBuzFUg
+XjX1Dif5Z0JqDvcWWm59UAbAdZYYYreVX7EjdWbQ4TJtBOuQJA8313Ld8sQ/2x0L
+Cu95xa+aod1AmZKWNde4PZkgrPAuD/0jJX1XVCBYH43rZpJbIz3K3ALv73Oh6et8
+0UHwc0gb9N8cG5gzuEm2GwqaEW0XQgeZfFNNdZ/BgZRRr8njIqF3pt4M+rwmPaz+
+jiflHxV1fnqG6XIclbUV/ht7
+=ser0
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:64.sysvsem.asc b/website/static/security/advisories/FreeBSD-SA-26:64.sysvsem.asc
new file mode 100644
index 0000000000..ebecc1bf7c
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:64.sysvsem.asc
@@ -0,0 +1,158 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:64.sysvsem Security Advisory
+ The FreeBSD Project
+
+Topic: Heap out-of-bounds access in semop(2)
+
+Category: core
+Module: sysvsem
+Announced: 2026-09-29
+Credits: Reo Shiseki
+Credits: Andrew Griffiths
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-09-29 15:56:17 UTC (stable/15, 15.1-STABLE)
+ 2026-09-29 16:00:02 UTC (releng/15.1, 15.1-RELEASE-p4)
+ 2026-09-29 15:59:12 UTC (releng/15.0, 15.0-RELEASE-p14)
+ 2026-09-29 15:56:36 UTC (stable/14, 14.5-STABLE)
+ 2026-09-29 16:09:04 UTC (releng/14.5, 14.5-RELEASE-p1)
+ 2026-09-29 15:57:26 UTC (releng/14.4, 14.4-RELEASE-p10)
+CVE Name: CVE-2026-58098
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+System V semaphores are a kernel-provided Inter-Process Communication
+(IPC) mechanism that allows processes to synchronize using sets of
+integer counters.
+
+The semop(2) system call performs atomic operations on a semaphore set,
+and may block the calling process until the requested conditions are
+met.
+
+II. Problem Description
+
+When semop(2) blocks waiting for a semaphore condition, it releases the
+per-set lock and sleeps. Upon waking, it checks the sequence number
+embedded in the semaphore set's IPC identifier to detect whether the
+set was removed while the caller was asleep. This sequence number is
+only 15 bits wide. If enough semaphore sets are created and destroyed
+in the same table slot while a caller is blocked, the counter wraps
+around, and semop(2) may falsely conclude that the original set still
+exists. The subsequent access to a semaphore within the set may then
+be out of bounds.
+
+III. Impact
+
+An unprivileged local user can trigger an out-of-bounds access on kernel
+heap memory, potentially leading to privilege escalation.
+
+IV. Workaround
+
+No workaround is available.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/SA-26:64/sysvsem.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:64/sysvsem.patch.asc
+# gpg --verify sysvsem.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 8063b1b61ae8 stable/15-n285676
+releng/15.1/ aff64c19ebb8 releng/15.1-n283615
+releng/15.0/ fc5c2fd47117 releng/15.0-n281116
+stable/14/ 04f841a05836 stable/14-n275239
+releng/14.5/ a412d0c46d36 releng/14.5-n274875
+releng/14.4/ 9bb6f92b5d1b releng/14.4-n273768
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-58098>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:64.sysvsem.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmq8DLEbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvqGMP/0xCX38+MfKT4kb/Q6Bs
+3V+xYOL4pl8qN6Aht96T+ViIRW3bStGlWvWZDDo3t8DE8JJ0tnbHv5kntc0koCRa
+COPNpB0Q/rM3cVC6S5HC/bYBRHK4kawFf9XYw6KRWRRTbc9bV941XlNPpKulITIe
+DNQtx9mewN1XiLAmEp0qWW83z60wjYVugjwLMGfzeT8llhhWxJxPymLE3UWfSDe4
+xbK6SlFfxHkNhu+mTpgHNvaS0Ct9v+f2NcL0SRo5LP+K0WfNrAus17HsMgjKBEfH
+UzMCkJhd/SZbhm6dv5SQylaeEChCHSSEUmwBGV2Ly3UEDXeELHv11WeP7E30XozT
+75pDMm1/t/FUCkOJdzGxThvbvpEV3jbbfZllAqcAhcr6dzO6aT/7lP2eTE2Rng4s
+QV9guxAqAyAb1EXPUxzKftKV358FjJbWlCbrp/Tdwi0E50zhBemvDeySN5cAlUZl
+4RsPZ6VXkUkHTDPZqf/mvoeYRLJFe7CrPlfUrAJWpS71+AU3CGUIYd5070PDqqnd
+8IV8VMU0gB51gYZpCC0q/ewe1b8rHT8AOC6HRXZPF2fYtE0IpctuPfqSNTKQKpnb
+vxA8DowZDCYS8I1YKg15lF6NEhSQKETIpmDmcSpQcgu8oQPZsrxZDE4Qnzfv5YgT
+FWO42b+ROUo2BQKMEXHiWz5E
+=mm5X
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:65.kqueue.asc b/website/static/security/advisories/FreeBSD-SA-26:65.kqueue.asc
new file mode 100644
index 0000000000..1872ecf146
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:65.kqueue.asc
@@ -0,0 +1,153 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:65.kqueue Security Advisory
+ The FreeBSD Project
+
+Topic: Memory safety bugs in kqueue copy-on-fork implementation
+
+Category: core
+Module: kqueue
+Announced: 2026-09-29
+Credits: Reo Shiseki
+Credits: Mark Johnston
+Affects: FreeBSD 15.1
+Corrected: 2026-09-29 15:56:19 UTC (stable/15, 15.1-STABLE)
+ 2026-09-29 16:00:04 UTC (releng/15.1, 15.1-RELEASE-p4)
+CVE Name: CVE-2026-58099, CVE-2026-58100
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+The kqueue(2) system call provides a scalable mechanism for kernel event
+notification. Processes register interest in events using knotes, and
+kqueue notifies them when registered events occur. kqueue also supports a
+copy-on-fork mode (KQUEUE_CPONFORK) in which knotes are duplicated into the
+child process during fork(2).
+
+II. Problem Description
+
+When copying knotes from a parent kqueue to a child, the copy code did
+not correctly exclude marker knotes (used internally to track list
+traversal position) before marking them as in-flux and releasing the
+kqueue lock. If another thread freed a marker while the lock was
+dropped, the subsequent in-flux decrement operated on freed memory.
+(CVE-2026-58099)
+
+kqueue_fork_copy_knote() indexed into the child's file descriptor
+table using a knote's file descriptor number without a bounds check.
+Because the child's table is copied before knotes are transferred, a
+concurrent thread in the parent could grow the parent's table and
+register knotes with file descriptor numbers beyond the end of the
+child's table, causing an out-of-bounds read. (CVE-2026-58100)
+
+III. Impact
+
+An unprivileged local user may be able to exploit these races to escalate
+privileges.
+
+IV. Workaround
+
+No workaround is available.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/SA-26:65/kqueue.patch
+# fetch https://security.FreeBSD.org/patches/SA-26:65/kqueue.patch.asc
+# gpg --verify kqueue.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch -E -p0 < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash in the
+following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/15/ 5db05b5dedf3 stable/15-n285678
+releng/15.1/ 2b66c28a0383 releng/15.1-n283617
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-58099>
+<URL:https://www.cve.org/CVERecord?id=CVE-2026-58100>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:65.kqueue.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmq8DLQbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvR40P/303lDROS4wJawGiimer
+lZAMchuNXv9/caxxigTVNIgQ65tR9rIu5BkQxZ2ilSTOpJ0MvItXBP3W2P2583Tv
+t8lPDqxHeXCpz3ESq/U/16Qaq11/gFOHLIezVZhNi3TbdUAOi2zKCIO7KUyGjYfm
+j5Qdky5spzp3Ik03BEvaANOl2qvjWEKTz/syEc++vJXV1nvttSZRUbZDM6jkfOXZ
+DckIsoa2ZIhIC1+bXMl4GztVepHlnuXcTg/VVxoNRmw5as8rVWycT17oyBSG+ATt
+GUWW5s7tKd75iqxR4HdWACI4tidohDlGHWL7ej0WlAiYEV1WyhX8smwYNzM+bCYL
+5ylQXw25bW8Jnrl88Uhpgp9qIII1rfLJKVwkXlrxifH9t24PrYGVM8hwsuY9umt7
+ff+edIuSV3xelPgiMbfFd9o5cWKLMfkrFGLq0ELpH4IHU85B9OydUitTF1MoE4Zq
+7ZUxrujaZFV9UuB1Znqfn7nf+UlmQVPT/QyQXbjNid0qgKjdZuEEaF4al7kvj+Cs
+AE/ZsCpYb30MUcNA8A/pP+K0BPMAKQm0ls6lCW15k5gjROy3GcnvUo+ekSYmQab7
+V1ToPsBwFt98ARJBeMFCrZUYAUuQA6s6o/dUduLNoGepmr8yXxAUopQr6K9SW7pT
+dyQUI5qCsNFh2qwxlI3JIyR+
+=wM7V
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-26:66.jail.asc b/website/static/security/advisories/FreeBSD-SA-26:66.jail.asc
new file mode 100644
index 0000000000..4da8cf96fd
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-26:66.jail.asc
@@ -0,0 +1,184 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-26:66.jail Security Advisory
+ The FreeBSD Project
+
+Topic: Multiple jail filesystem root escapes
+
+Category: core
+Module: jail
+Announced: 2026-09-29
+Credits: Jan Bramkamp
+Credits: firk
+Affects: All supported versions of FreeBSD.
+Corrected: 2026-09-29 15:56:24 UTC (stable/15, 15.1-STABLE)
+ 2026-09-29 16:00:09 UTC (releng/15.1, 15.1-RELEASE-p4)
+ 2026-09-29 15:59:18 UTC (releng/15.0, 15.0-RELEASE-p14)
+ 2026-09-29 15:56:41 UTC (stable/14, 14.5-STABLE)
+ 2026-09-29 16:09:09 UTC (releng/14.5, 14.5-RELEASE-p1)
+ 2026-09-29 15:57:35 UTC (releng/14.4, 14.4-RELEASE-p10)
+CVE Name: CVE-2026-101304, CVE-2026-101305, CVE-2026-101306
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+FreeBSD jails provide lightweight operating system virtualization and
+confine processes to a restricted view of the filesystem. When a
+directory file descriptor is passed between jails using SCM_RIGHTS
+over a Unix domain socket, the receiving process's copy has the
+FD_RESOLVE_BENEATH flag set, which restricts path lookups through
+that descriptor to paths within the referenced directory.
+
+II. Problem Description
+
+Three flaws allow a jailed process to bypass FD_RESOLVE_BENEATH:
+
+When fdescfs(4) was mounted in a jail with the "nodup" option, opening
+/dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or
+the Capsicum capability rights of descriptor N. (CVE-2026-101304)
+
+renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory
+arguments. A jailed process could rename a directory relative to a
+restricted descriptor, then escape the jail root via fchdir(2).
+This requires the directory to reside on a filesystem that is also
+reachable from the jail's root. (CVE-2026-101305)
+
+SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH
+when a descriptor was transferred. A process could clear the restriction
+by sending the descriptor to itself over a Unix domain socket.
+(CVE-2026-101306)
+
+III. Impact
+
+A process in a jail that has received a directory file descriptor
+from another jail can use these techniques to escape the jail's
+filesystem root restriction.
+
+IV. Workaround
+
+No workaround is available, but systems that do not pass directory file
+descriptors into jails are not affected.
+
+V. Solution
+
+Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date,
+and reboot the system.
+
+Perform one of the following:
+
+1) To update your vulnerable system installed from base system packages:
+
+Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
+arm64 platforms, which were installed using base system packages, can be
+updated via the pkg(8) utility:
+
+# pkg upgrade -r FreeBSD-base
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your vulnerable system installed from binary distribution sets:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
+which were not installed using base system packages can be updated via the
+freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
*** 5821 LINES SKIPPED ***