Hi, this is the Mlmmj program managing the <freebsd-announce@FreeBSD.org> mailing list. Some messages to you could not be delivered. If you're seeing this message it means things are back to normal, and it's merely for your information. Here is the list of the bounced messages: - 311, Message-ID: <20260825193315.644B33B19@freefall.freebsd.org>
Tuesday, August 25, 2026
FreeBSD Security Advisory FreeBSD-SA-26:59.mac_do
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:59.mac_do Security Advisory The FreeBSD Project Topic: Unauthorized credential switching Category: core Module: mac_do Announced: 2026-08-25 Credits: Hazley Samsudin of GovTech CSG Affects: FreeBSD 15.0 and later Corrected: 2026-08-25 15:59:49 UTC (stable/15, 15.1-STABLE) 2026-08-25 16:01:24 UTC (releng/15.1, 15.1-RELEASE-p3) 2026-08-25 16:01:03 UTC (releng/15.0, 15.0-RELEASE-p13) CVE Name: CVE-2026-58092 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background mac_do(4) is a MAC policy module that allows unprivileged processes to switch credentials using setcred(2), subject to administrator-defined rules. Rules can restrict transitions based on the calling process' user and group identities. II. Problem Description In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible. One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group. As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential's supplementary group array. If the list of supplementary groups is empty, this value will be 0, corresponding to the "wheel" group. For example, a rule such as "uid=1001>uid=1002" can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0. III. Impact Certain mac_do rules can be abused to set a process' group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset "uid=1001>uid=1002", the user must have user ID 1001 in order to trigger the bug. Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the credential's first supplementary group ID as its primary group ID. Processes must explicitly remove themselves from all supplementary groups, using the privileged setgroups(2) system call, in order to exploit the bug to set 0 as the primary group ID. Since membership in group 0 is often used to enable controlled privilege escalation, the bug might be further exploitable to obtain root privileges, depending on the system configuration. For instance, a ruleset such as the following could be exploited by a process running as user 1001 and with an empty supplementary group list: "uid=1001>uid=1002;gid=0>uid=0". IV. Workaround Systems that do not configure a mac_do ruleset are not affected. Rulesets which explicitly specify a target group ID are not subject to the bug. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:59/mac_do.patch # fetch https://security.FreeBSD.org/patches/SA-26:59/mac_do.patch.asc # gpg --verify mac_do.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ ae27dff4710b stable/15-n285145 releng/15.1/ 97b7439e3b06 releng/15.1-n283604 releng/15.0/ 00036dad647f releng/15.0-n281107 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-58092> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:59.mac_do.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3YIbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvS4IP/3NC1xmoJ/sd/RZLqW1f oLSf3q4coxvjbzjBsZc4um+nkiwEWdjX9ZXzZ+KR0XVV6VgXkhhEPqARmcc4OPTo nduczWRyqNzRTGzzWi0QpmY+K764ZA2rObChnc8Bs/s75dl9AXinjF9G0hMM29i7 dfcsh8vPLFPkdtXtiReGFrf7c6CryOqEZfAW71FQCv6q1/0YEiogWfeb+mvvfhOq qj2xxSAbNeIwXqOtTQ2IiZMEfFAR+0TZ506iWesxoEI9JoHBSoSkb0ZZLCUybr26 iCIhA0yA9sxnFVYvsbbLsatNTxyP9cR5gryJDYQCzwwm9TmdWp74PzGKvtdYN5TC rQi+6Ounfbt1ez6IYr6r54HCgAb7jNljiTEi0P8xJSvFuJcSvGJptzl6gZP2kIUS GH0PFIau2uXD0Lbh+aqkMAJKRnOzGx1ixCalhpFvg0b8CGEbCjiTooQaW641quWu ClquL69lzQljKikV8Qq0DobxBJRbGLREfIa8xCW4/Hf74ni7YrMQZBbzua3y4L2s lJaZumo2Capf7OT0A/ux5TAvmsY9X7pNg7K3GJ3apWgxRZu2bBeTm3j2+1skIhoN Fx7VgqyLboTxLkCUYohaLtcSav6ZKmhH8pUBkK/WutiZR8NLjfMoB8x+ZinL05Ym 0C2jYUClN06hrVUeSTwgh8Eu =Uvrm -----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-26:57.unix
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:57.unix Security Advisory The FreeBSD Project Topic: Use-after-free in unix SOCK_STREAM message handling Category: core Module: unix Announced: 2026-08-25 Credits: Mark Johnston Affects: FreeBSD 15.0 and later Corrected: 2026-08-24 16:29:47 UTC (stable/15, 15.1-STABLE) 2026-08-25 16:01:22 UTC (releng/15.1, 15.1-RELEASE-p3) 2026-08-25 16:01:01 UTC (releng/15.0, 15.0-RELEASE-p13) CVE Name: CVE-2026-58090 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background Unix domain sockets provide a mechanism for processes on the same host to communicate. Processes can use unix domain sockets to exchange file descriptors, using the SCM_RIGHTS control message type. II. Problem Description The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. III. Impact An unprivileged local user can exploit this use-after-free to escalate privileges. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:57/unix.patch # fetch https://security.FreeBSD.org/patches/SA-26:57/unix.patch.asc # gpg --verify unix.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 06833c3e9813 stable/15-n285079 releng/15.1/ 0e4c26a82cb1 releng/15.1-n283602 releng/15.0/ 21de91422ca2 releng/15.0-n281105 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-58090> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:57.unix.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3X0bFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvlAsP/1eqhZQS/YtepDbHml3h Cjuzc3eHFelAfDhMDaAn1/KJv6fUNHaJ3NQipdKL9hU78tXKIG287Ld3BpExBvp/ 7ODQiYENW94Nx07sm0HL9Qa0lznAQtUsniZ2mlua9+t00eYnEHd8qJkeL369IGhI qfpeIjbELLS6kkC8r6LVEI0ncDmeieXBcL20amwSASzWarw6HpWucF6zot/FOfUE S6hn8fLO+IQj+min9DzMGjNDq3r/dqDKXMXv68+En+5dhmO4HMOSibfTa1YdKfW4 SJziul0mOfaMWMCssd3b2HN5SHe9vx4vtf7TpBWfAvREbF3F95eelTzKrEkS+8Vx CvK6ApUukBG/866bATVri2bXnnnVuERXxi/1vMevd7dDcCZWrg/FKquoqzl/n1AD MM0U5PCn3PdCFJDNlNf8+ShYv9uFA6w7S2CJAkGW2oNdR9WKZcOHu4bwvxBod2hj xhk7xZ+hzv5Fb7ulf2bsi87BhDWrkOvRmCHh5oRKbGX/FrvUx3V1OCuFbnORxCJT g2MQOl7jBhhf0Gagy1bOIrqw/JH3m1Y2Lk6FgJLfNF6R1YJbWZg5oV3WIraUBr25 EruKOmOw4CTwL0hpUX2+wO1+/QaoW1JDb3GC7wSADRNNMCnTCtFJvNS+f+jcOchL usbogTLMhfpofgBignADKZsd =7aT1 -----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-26:56.hwpmc
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:56.hwpmc Security Advisory The FreeBSD Project Topic: hwpmc fails to detach PMCs during exec credential transitions Category: core Module: hwpmc Announced: 2026-08-25 Credits: Alexander Leidinger Affects: All supported versions of FreeBSD. Corrected: 2026-08-25 15:59:47 UTC (stable/15, 15.1-STABLE) 2026-08-25 16:01:17 UTC (releng/15.1, 15.1-RELEASE-p3) 2026-08-25 16:00:57 UTC (releng/15.0, 15.0-RELEASE-p13) 2026-08-25 16:00:00 UTC (stable/14, 14.4-STABLE) 2026-08-25 16:00:24 UTC (releng/14.4, 14.4-RELEASE-p9) CVE Name: CVE-2026-58089 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background The hwpmc(4) driver implements support for hardware performance monitoring counters (PMCs). These counters can be used to collect fine-grained performance data about a running process. Unprivileged processes may attach PMCs to themselves or, subject to restrictions, to other processes. II. Problem Description When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. III. Impact An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy. IV. Workaround No workaround is available. Systems that do not use hwpmc(4) are not affected. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 15.x] # fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-15.patch # fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-15.patch.asc # gpg --verify hwpmc-15.patch.asc [FreeBSD 14.x] # fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-14.patch # fetch https://security.FreeBSD.org/patches/SA-26:56/hwpmc-14.patch.asc # gpg --verify hwpmc-14.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 87bb4aa63ac7 stable/15-n285143 releng/15.1/ e034ae898328 releng/15.1-n283598 releng/15.0/ 57a2373f86ac releng/15.0-n281101 stable/14/ 5eaecdb275d3 stable/14-n275045 releng/14.4/ 97e1e603bd40 releng/14.4-n273758 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-58089> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:56.hwpmc.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XkbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvyS8QAJsPGY/8wHJ68UEVlA1E ErNiUMinhBy8aILiGhHE9SQjgKRh/RPvFyJMcjDbIaYRlAdyL1GNKgv8+cfK9VPX XdC2WsK1roLvKS5qEfQu9BNLB4pXFT0vtrfX2leEDdI2imZAXRN94VEhGFS+7hFn L+pDhFMKQmi9Rimzmtg3EJyxvh05FMZc0oyjI0wYT8vPIYDq73mFVYIKScpPZFFc Cm5RKTfZ0X8Xc2EtP2p8KvXi44A7iwPQnbJ3sm/A8Q8zxv0kK+cFWXiIkV1dTzA5 w2NRBRFaAamNXKTx2VirDHp9bb5bjw6esABeWKrS7jdLJpmEXHoJ8P55Oti+aLya hsJpvO4Ewrx7xVS6RGXrJCB04rvDWMkt/b8j670yQyrjvjGjPGCVpS5PeS/LcJG3 aXpqIn88q6b9pULduYyuTygiSRFDu9W6bicgjyucoOdF9wP99auJnsyF6bu0tnnc HI8f95/39Iz7GR1Ra2bWGfXr3K0savJpGKxon8kdcHCk/HTIbq3oo8mqWKsfYnBy 7s+w4lb/FGIXddZbYYhLrbJvWNvq2TI2HlXz/AJzlUEnnm8IznvkRlJ/AQtkgDHS I3mA7dnpnIzKnIv5P54LUBCIUFl89Ry65aKdCnWgM64FgqgRBq4u6mDYl/fOBBPp Z0TtIs7yRcatGRez2+WsVpIb =TEZX -----END PGP SIGNATURE-----
FreeBSD Errata Notice FreeBSD-EN-26:21.openssl
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-26:21.openssl Errata Notice The FreeBSD Project Topic: OpenSSL pkg-config files contain incorrect versions Category: contrib Module: openssl Announced: 2026-08-25 Affects: FreeBSD 14.4 Corrected: 2026-08-07 19:37:45 UTC (stable/14, 14.4-STABLE) 2026-08-25 16:00:23 UTC (releng/14.4, 14.4-RELEASE-p9) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured Open Source toolkit for the Transport Layer Security (TLS) protocol. It is also a general-purpose cryptography library. Alongside the libraries, the base system installs the pkg-config metadata files libcrypto.pc, libssl.pc, and openssl.pc in /usr/libdata/pkgconfig. These record the compiler and linker flags needed to build against OpenSSL, along with the version installed. II. Problem Description The pkg-config files are no longer generated at build time and are instead maintained in the source tree. The copies checked in on FreeBSD 14 were taken from the OpenSSL 3.5 branch and reported version 3.5.1, while the OpenSSL release actually installed on that branch is 3.0.x. III. Impact Software that queries pkg-config to determine the installed OpenSSL version is told 3.5.1, and may assume interfaces that OpenSSL 3.0 does not provide. A build gated on the reported version can fail to compile or link, or select a code path unsuited to the installed library. The OpenSSL libraries themselves are correct and unaffected. IV. Workaround The version can be corrected in place by editing the Version: line in /usr/libdata/pkgconfig/libcrypto.pc, libssl.pc, and openssl.pc to match the version reported by openssl(1). Systems that do not build software against the base system OpenSSL are not affected. V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. No reboot is required. Perform one of the following: 1) To update your system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 14.4] # fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch # fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch.asc # gpg --verify openssl.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ 2e04d9868823 stable/14-n274843 releng/14.4/ 357aa8af5304 releng/14.4-n273757 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297144> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:21.openssl.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XcbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvveEQANAsU2LZOxLqjTPrYqlX 3/I8qWIaPJtl4zSFsgdHu2OwXUqxlY9+O24OO/0CrjC+0aC5cHtKao7/+59n0HAF Do8EAKduRTWlt+/+VkIc+BuDi/iUnYseYleBZ5lyb16NhwMUYuAgST7M39NgoSmY b521yI7H/d7NxKZ+qKG10/f1xGXIkAms+RrEbRwoxoFWHj8rpsOMwYl7zPRBenBi RmcEILQzjtqSunuy7BEPBpjlx6u8vbaLcer38mqPMA4EjUTw9HdTlwj4ND+rmCT6 fahABXBm1eugESTuowmb2fNpuyLWi8YEr8VFknN72NB+AoPHkdeAvjWghvLVvtc0 mU0wEqs7Mz04TGHwKJ3Tx+dyE/UlhDK8oZm19aWVZfB66h81orISfUFlB7F343yf t0/6z/Z/C4M3srB4z4woX5fJaIrs10yubt2HH/Jvrq4XslfCgD9U3NdXkhzHJBam r8HmKpsnQcmVI3ebhjfoHLLbPc73pXND/jLpc8VvqVNNNh5vwMFFnb6rq46GxfZI GfClFjF6u2/Hgf6WkJCd65iNb/fiFHUuxjwSkFTMWvbpP580NtOG5p2Lq5ksyxfz Jr76q3Fx+zJItwMmywwt0m6oJiJgDDNG8WT7goTpDn3/VMJs6mpyP8XUmIWGQN0F PO/wgtwmKw2HwVKwCfskM4tk =hF2I -----END PGP SIGNATURE-----
FreeBSD Errata Notice FreeBSD-EN-26:20.microcode
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-26:20.microcode Errata Notice The FreeBSD Project Topic: Early loading of Intel CPU microcode fails for some CPUs Category: core Module: ucode Announced: 2026-08-25 Affects: All supported versions of FreeBSD. Corrected: 2026-06-15 18:01:43 UTC (stable/15, 15.1-STABLE) 2026-08-25 16:01:16 UTC (releng/15.1, 15.1-RELEASE-p3) 2026-08-25 16:00:56 UTC (releng/15.0, 15.0-RELEASE-p13) 2026-07-14 14:56:07 UTC (stable/14, 14.4-STABLE) 2026-08-25 16:00:22 UTC (releng/14.4, 14.4-RELEASE-p9) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background Modern x86 CPUs support updates to their microcode. FreeBSD can apply these updates in two ways: "early loading," performed by the kernel during boot before CPU feature detection, and "late loading," performed after boot by cpucontrol(8) or the microcode_update rc(8) service. An Intel microcode distribution file may describe the CPUs an update applies to using a primary signature in the image header and, optionally, an extended signature table listing additional matching signatures. II. Problem Description The kernel's early-loading matcher, ucode_intel_match() in sys/x86/x86/ucode.c, contained an inverted bounds check that caused the extended signature table to always be treated as absent. Consequently, a CPU whose matching signature+platform pair appears only in an image's extended signature table was never matched during early loading, and its microcode update was not applied. The kernel reports "CPU microcode: no matching update found" in this case. Late loading via cpucontrol(8) is not affected. There, the userland matcher parses extended signature tables correctly. III. Impact On affected Intel CPUs, early loading applies no microcode update even when a suitable update is present in the loaded file. Such systems run with only the microcode installed by the system firmware (BIOS/UEFI), which may be older than the packaged update and may lack functional or security-related errata fixes. At the time of writing, 19 CPU signatures / 58 signature+platform combinations in the packaged Intel microcode are affected, spanning various Alder Lake, Raptor Lake, Sapphire Rapids, and Emerald Rapids steppings, as well as some newer Intel Core Ultra client processors. To determine whether your system is affected, run the following commands as root: # kldload -n cpuctl # cpucontrol -i 0x01 /dev/cpuctl0 If the first hexadecimal value (the CPUID signature) appears in the following list, the system is affected by the bug. 0x000806f4 0x000806f5 0x000806f6 0x000806f7 0x00090675 0x000906a4 0x000b0674 0x000b06a3 0x000b06a8 0x000b06f2 0x000b06f5 0x000b06f6 0x000b06f7 0x000c0652 0x000c0664 0x000c06a2 0x000c06c2 0x000c06c3 0x000c06f1 Note, for signature 0x000906a4, only systems with platform ID 7 are affected. These report 0x001c0000 as the first value in the output of "cpucontrol -m 0x17 /dev/cpuctl0". Systems whose CPU signature matches an image's primary header, and all AMD systems, are unaffected. IV. Workaround Use late loading instead of, or in addition to, early loading. Install both sysutils/cpu-microcode-intel and sysutils/cpu-microcode-rc and enable the service: # sysrc microcode_update_enable="YES" # service microcode_update start V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your system installed from base system packages: Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r now 2) To update your system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r now 3) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch # fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch.asc # gpg --verify microcode.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 2a1eaaf331f7 stable/15-n283974 releng/15.1/ a0e96483e2ce releng/15.1-n283597 releng/15.0/ 4a66af1ce037 releng/15.0-n281100 stable/14/ 38cbd2588f0b stable/14-n274496 releng/14.4/ c905b341204e releng/14.4-n273756 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://reviews.freebsd.org/D57209> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:20.microcode.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XAbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvse4P/isqmBRUFLLUnVFS/AD7 Wlg20e54L4CRORCqhL1p33WdcKs6bHg7Tgvutwy23HmX9ISrOanm5WkFq2qN16qc olNJDvlXHLeIseDH6WQrxWiBooYqqJpLOJyolqB+R0TIGRvRMidbdM24gHyOCWST MvraPYkqkQH9DSO1CYUHoLTcVLek/l9ux1p2WApHSqOw7GPcltiYUnyvKrOqBxYs DD4n0GIw0JfsXK1L9MLXJILjROUpItDHnv1CsG8VVaWQI0c+5826dTVoFsDQ1RUc mcIiBiWP/gmKxl48wzjq9qZccGN2vHMLrFYA0Zu/syqpB2g5b0zQbm9iKIak+YIJ mKHTUGAZ0YJpQAXf8f1q+pED91Veh9k0fIvnSwsDa2dfgk2XMfZeWIyHbddxS0p6 fvnCroT4sMvequ2wpC64jpebASmwjiZYYY9gPk2TdgOlu83PnYUkMbT4gv5RHgIo qwK7WQ2bDO3GaRHGQ3Zfo/Dl97bGg6KDDZZEbFOBv9hWu2bKgmLMvo2HtgKGGLDa UBGypDYWC0abbtbaqTBFtJsvUbcpf6llG/lJT6YaipVrqBjLyNFJhETS1zNIQQSr Y8pvUc+tsqlLmrI4AaqcvIwC0OY6ATppQ49ZMpujaDf3nj9wG9vw6d1l12kIWjEE 0XE3NnDLvAne7G2cC+ktwGzB =KmJ4 -----END PGP SIGNATURE-----
Re: F45 Changes 'Complete' Deadline Today
Correction: Please mark your change to ON_QA only, if appropriate. The 'closed' state is not required at this time. Apologies for any confusion caused.
On Tue, Aug 25, 2026 at 12:41 PM Aoife Moloney <amoloney@redhat.com> wrote:
Hi all,
If you are a change owner for F45, your change is required to be
'Complete'[1] by today, August 25, 2026 as per our release schedule[2].
Please ensure your tracker bug is updated with the latest information
and/or the status of your tracker bug is marked to ON_QA or Closed.
An incomplete changes report will be filed with FESCo tomorrow for review.
If you would like to defer your change to F46[3], please let me know
and I will update the tracking links accordingly. A full list of our
current F45 change set can be found on the change set page[4].
Kindest regards,
Aoife
[1] https://docs.fedoraproject.org/en-US/program_management/changes_policy/#_change_process_milestones
[2] https://fedorapeople.org/groups/schedule/f-45/f-45-key-tasks.html
[3] https://fedorapeople.org/groups/schedule/f-46/f-46-key-tasks.html
[4] https://fedoraproject.org/wiki/Releases/45/ChangeSet
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
-- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
Fedora 45 Bodhi enablement and Beta freeze
Hi all, Today's an important day on the Fedora Linux 45 schedule [1], with several significant cut-offs. First of all, today is the Bodhi updates-testing activation point [2]. That means that from now on all Fedora Linux 45 packages must be submitted to updates-testing and pass the relevant requirements [3] before they will be marked as 'stable' and moved to the Fedora Repository. Today is also the Beta freeze [4]. This means that only packages which Fix accepted blocker or freeze exception bugs [5][6] will be marked as 'stable' and included in the Beta composes. Other builds will remain in updates-testing until the Beta release is approved, at which point the Beta freeze is lifted, and packages can move to 'stable' as usual until The final freeze. Today is also the Software String freeze [7], which means that strings marked for translation in Fedora-translated projects should not now be Changed for Fedora Linux 45. Finally, today is the 'completion deadline' Change Checkpoint [8], meaning that Fedora Linux 45 Changes must now be 'feature complete or close enough to completion that a majority of its functionality can be tested'. All tracking bugs should be on ON_QA state or later to reflect this. Regards, Samyak Jain Fedora Release Engineering [1] https://fedorapeople.org/groups/schedule/f-45/f-45-key-tasks.html [2] https://fedoraproject.org/wiki/Updates_Policy#Bodhi_enabling [3] https://fedoraproject.org/wiki/Updates_Policy#Branched_release [4] https://fedoraproject.org/wiki/Milestone_freezes [5] https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process [6] https://fedoraproject.org/wiki/QA:SOP_freeze_exception_bug_process [7] https://fedoraproject.org/wiki/ReleaseEngineering/StringFreezePolicy [8] https://fedoraproject.org/wiki/Changes/Policy -- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
F45 Changes 'Complete' Deadline Today
Hi all, If you are a change owner for F45, your change is required to be 'Complete'[1] by today, August 25, 2026 as per our release schedule[2]. Please ensure your tracker bug is updated with the latest information and/or the status of your tracker bug is marked to ON_QA or Closed. An incomplete changes report will be filed with FESCo tomorrow for review. If you would like to defer your change to F46[3], please let me know and I will update the tracking links accordingly. A full list of our current F45 change set can be found on the change set page[4]. Kindest regards, Aoife [1] https://docs.fedoraproject.org/en-US/program_management/changes_policy/#_change_process_milestones [2] https://fedorapeople.org/groups/schedule/f-45/f-45-key-tasks.html [3] https://fedorapeople.org/groups/schedule/f-46/f-46-key-tasks.html [4] https://fedoraproject.org/wiki/Releases/45/ChangeSet -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney -- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
Sunday, August 23, 2026
rpki-client 9.9 released
rpki-client 9.9 has just been released and will be available in the rpki-client directory of any OpenBSD mirror soon. It is recommended that all users upgrade to this version for improved reliability. rpki-client is a FREE, easy-to-use implementation of the Resource Public Key Infrastructure (RPKI) for Relying Parties to facilitate validation of BGP announcements. The program queries the global RPKI repository system and validates untrusted network inputs. The program outputs validated ROA payloads, BGPsec Router keys, and ASPA payloads in configuration formats suitable for OpenBGPD and BIRD, and supports emitting CCR, CSV, and JSON for consumption by other routing stacks. See RFC 6480 and RFC 6811 for a description of how RPKI and BGP Prefix Origin Validation help secure the global Internet routing system. rpki-client was primarily developed by Kristaps Dzonsons, Claudio Jeker, Job Snijders, Theo Buehler, Theo de Raadt, and Sebastian Benoit as part of the OpenBSD project. This release includes the following changes to the previous release: - Introduce a backoff retry mechanism for non-functional CAs, eventually settling on retrying broken CAs only once per day. Backoff helps reduce load on both the RP itself and the publication points. It reduces log clutter and improves RP run duration. - Support for OpenSSL 4. - Add additional fail safe: only output config files on successful run. - In Rsync mode, include .gbr files in transfer for backwards compatibility. - Exclude hidden files and directories ('/.*') when synchronizing via Rsync. From a report by Ben Cartwright-Cox. - Limit the length of filenames as they appear in various ASN.1 fields to 255. - Improve readability by printing CCR ManifestState sorted by AKI. - Improve warnings related to malformed CCRs. Reliability fixes: - Limit the range of deltas added to the queue. Reported by Xin Wang. - Rework error handling in rrdp_handle_file. Reported by Xin Wang. - Ensure consistent states in persistent HTTP connections. Reported by Xin Wang. - Tighten well-formedness checks on AIA & SIA extensions in certs. Reported by Ties de Kock. - Clear last_modified after each response on a persistent HTTP connection. Reported by Ties de Kock. - ASPAs with too many providers are no longer included in CCR output. Reported by Ties de Kock. - Replace assert() with a graceful failure by aborting the http request. Reported by Frank Denis. - Fix a off-by-one in the internal IP address overlap checker. Reported by Frank Denis. rpki-client works on all operating systems with a libcrypto library based on OpenSSL 1.1 or later, LibreSSL 3.6, a libtls library compatible with LibreSSL 3.6 or later, expat and zlib. rpki-client is known to compile and run on at least the following operating systems: Alpine, CentOS, Debian, Fedora, FreeBSD, Red Hat, Rocky, Ubuntu, macOS, and of course OpenBSD! It is our hope that packagers take interest and help adapt rpki-client-portable to more distributions. The mirrors where rpki-client is available can be found on https://www.rpki-client.org/portable.html Reporting Bugs: =============== General bugs may be reported to tech@openbsd.org Portable bugs may be filed at https://github.com/rpki-client/rpki-client-portable We welcome feedback and improvements from the broader community. Thanks to all of the contributors who helped make this release possible. Assistance to coordinate security issues is available via security@rpki-client.org.
Inactive packagers for the F45 release cycle
In accordance with FESCo's Inactive Packager Policy[1], packagers that have been identified as inactive have a ticket in the find-inactive-packagers repo[2]. One week after the final release, packagers who remain inactive will be removed from the packager group. (Note that pagure.io is one of the systems checked for activity, so commenting on your ticket that you're still around will prevent you from showing up in the second round.) If you have suggestions for improvement, look for the open feature issues[3] and file an issue in the find-inactive-packagers repo[4] if it's not there already. For the curious, here are the stats from today's run: ### Found 1391 users in the packager group. ### ### Found 557 users with no builds in Koji over the last year. ### ### Found 481 users with no activity in forge.fedoraproject.org in the last year. ### ### Found 369 users with no activity in src.fp.org over the last year. ### ### Found 353 users which didn't post any message in Fedora Discussion over the last year. ### ### Found 322 users which also show no activity in Bodhi over the last year. ### ### Found 302 users which also show no activity in mailing lists over the last year. ### ### Found 226 users which also show no activity in Bugzilla over the last year. ### [1] https://docs.fedoraproject.org/en-US/fesco/Policy_for_inactive_packagers/ [2] https://forge.fedoraproject.org/packaging/find-inactive-packagers/issues?q=&type=all&sort=relevance&labels=5210&state=open&milestone=0&project=0&assignee=0&poster=0 [3] https://forge.fedoraproject.org/packaging/find-inactive-packagers/issues?q=&type=all&sort=relevance&labels=-5210%2c5208&state=open&milestone=0&project=0&assignee=0&poster=0 [4] https://forge.fedoraproject.org/packaging/find-inactive-packagers/issues/new -- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
Saturday, August 22, 2026
OpenBSD Errata: August 22, 2026 (ifioctl nipledge kernproc ttyioctl expat)
Errata patches for kernel and libexpat have been released for OpenBSD 7.8 and 7.9. Binary updates for the amd64, arm64 and i386 platform are available via the syspatch utility. Source code patches can be found on the respective errata page: https://www.openbsd.org/errata78.html https://www.openbsd.org/errata79.html
Subscribe to:
Posts (Atom)