Loading story…
FreeBSD issued security updates for FreeBSD 14.3 and FreeBSD 13.5 to address multiple vulnerabilities, including a critical jail/chroot escape tracked as CVE-2025-15576. The flaw allows a process to break out of FreeBSD jail isolation by abusing file descriptor (fd) exchange between jails, resulting in loss of filesystem isolation and potential access to the host filesystem; the Canadian Centre for Cyber Security urged administrators to review the advisories and apply updates.
Technical reporting indicates CVE-2025-15576 can be triggered in specific configurations where two sibling jails share a directory via a nullfs mount and can communicate over a Unix domain socket. In that scenario, cooperating processes can exchange directory file descriptors in a way that causes the kernel’s pathname lookup checks to fail to properly enforce the jail root boundary, enabling access to directories outside the jail. No workaround was noted; patching is required. Separately, FreeBSD also addressed CVE-2026-3038, described as a local DoS with possible privilege escalation via routing sockets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On February 27, 2026, the Canadian Centre for Cyber Security issued alert AV26-179 highlighting FreeBSD's February 24 advisories and urging users and administrators to review them and install the necessary updates. The alert specifically referenced CVE-2025-15576 and CVE-2026-3038.
As part of the February 24, 2026 advisories, FreeBSD made fixes available for affected binary and source-based installations. Administrators were instructed to apply the updates and reboot, as no workaround was available for CVE-2025-15576.
On February 24, 2026, FreeBSD published security advisories for vulnerabilities affecting FreeBSD 14.3 and 13.5, including the jail/chroot escape flaw CVE-2025-15576 and the routing-socket issue CVE-2026-3038. The jail escape bug can allow filesystem isolation to be broken under specific sibling-jail and nullfs configurations, while the routing-socket flaw can cause local denial of service and may enable privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FreeBSD Project issued security advisory **FreeBSD-SA-26:10.tty** for **CVE-2026-5398**, a kernel use-after-free flaw in the `TIOCNOTTY` handler that affects all supported FreeBSD versions. The vulnerability occurs because `TIOCNOTTY` does not clear a back-pointer from the controlling terminal structure to the calling process session, leaving a dangling pointer after the process exits. FreeBSD warned that a malicious unprivileged local process could exploit the bug to gain **root privileges**. The project released fixes across supported stable and release branches on 2026-04-21, said **no workaround is available**, and directed administrators to apply the updates and reboot affected systems.
Jun 29, 2026
FreeBSD released security updates for **22 vulnerabilities** across the operating system, including multiple flaws that could lead to **remote code execution**, **local privilege escalation to root**, **denial of service**, **memory corruption**, and **information disclosure**. The most severe issue, **`CVE-2026-49420`**, affects `libalias`, where improper handling of **RTSP** traffic during NAT processing can allow **remote code execution as root** on systems using **`ipfw` NAT** or **`natd`**. The fixes were shipped in **FreeBSD 15.1-RELEASE-p1**, **15.0-RELEASE-p11**, **14.4-RELEASE-p7**, and **14.3-RELEASE-p16**. Additional patched components include `execve`, **Jail**, **OpenZFS**, **Linuxulator**, **KTLS**, `sound`, `vt`, `ptrace`, IPv6 multicast filtering, `tcp_rack`, `compat32`, `iconv`, and pathname resolution protections such as **`AT_RESOLVE_BENEATH`**, with the advisory noting that **13 of the issues** could enable privilege escalation to root.
Jul 7, 2026
FreeBSD issued security advisory **FreeBSD-SA-26:11.amd64** for **`CVE-2026-6386`**, a kernel flaw in the amd64 routine **`pmap_pkru_update_range()`** that mishandles **1GB large page mappings**. The bug affects all supported FreeBSD versions on amd64 and arises when largepage mappings created with **`shm_create_largepage(3)`** are not handled correctly, causing a page directory page entry to be misinterpreted as a pointer to another page table page. FreeBSD warned that an **unprivileged local user** could exploit the issue to make the kernel treat userspace memory as a page table page and overwrite memory the application should not be able to access, creating a serious path to memory corruption and potential privilege impact. The project said **no workaround is available** and advised administrators to upgrade to corrected branches released after **2026-04-21** and reboot affected systems; fixes were published for **stable/15**, **releng/15.0**, **stable/14**, **releng/14.4**, **releng/14.3**, **stable/13**, and **releng/13.5**.
Jun 29, 2026