Loading story…
FreeBSD issued security advisory FreeBSD-SA-26:11.amd64 for CVE-2026-6386, a kernel flaw in the amd64 routine pmap_pkru_update_range() that mishandles 1GB large page mappings. The bug affects all supported FreeBSD versions on amd64 and arises when largepage mappings created with shm_create_largepage(3) are not handled correctly, causing a page directory page entry to be misinterpreted as a pointer to another page table page.
FreeBSD warned that an unprivileged local user could exploit the issue to make the kernel treat userspace memory as a page table page and overwrite memory the application should not be able to access, creating a serious path to memory corruption and potential privilege impact. The project said no workaround is available and advised administrators to upgrade to corrected branches released after 2026-04-21 and reboot affected systems; fixes were published for stable/15, releng/15.0, stable/14, releng/14.4, releng/14.3, stable/13, and releng/13.5.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
FreeBSD issued corrected stable and release branches dated after 2026-04-21 for stable/15, releng/15.0, stable/14, releng/14.4, releng/14.3, stable/13, and releng/13.5. The advisory said there is no workaround and recommended upgrading and rebooting affected systems.
FreeBSD published security advisory FreeBSD-SA-26:11.amd64 for CVE-2026-6386, describing an amd64 kernel bug in pmap_pkru_update_range() that mishandles 1GB large page mappings. The flaw affects all supported FreeBSD versions on amd64 and could allow an unprivileged user to make the kernel treat userspace memory as a page table page and overwrite otherwise inaccessible memory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FreeBSD Project issued security advisory **FreeBSD-SA-26:10.tty** for **CVE-2026-5398**, a kernel use-after-free flaw in the `TIOCNOTTY` handler that affects all supported FreeBSD versions. The vulnerability occurs because `TIOCNOTTY` does not clear a back-pointer from the controlling terminal structure to the calling process session, leaving a dangling pointer after the process exits. FreeBSD warned that a malicious unprivileged local process could exploit the bug to gain **root privileges**. The project released fixes across supported stable and release branches on 2026-04-21, said **no workaround is available**, and directed administrators to apply the updates and reboot affected systems.
Jun 29, 2026
FreeBSD disclosed **CVE-2026-4747** in advisory **`FreeBSD-SA-26:08.rpcsec_gss`**, warning that improper bounds checking in RPCSEC_GSS packet-signature validation can copy attacker-controlled data into a fixed stack buffer and trigger a stack overflow. The bug affects all supported FreeBSD versions and can be exploited by an unauthenticated client. In the kernel, exploitation is possible when **`kgssapi.ko`** is loaded and the system is running an NFS server with RPCSEC_GSS enabled; in userspace, RPC servers linked against **`librpcsec_gss`** are also exposed, although FreeBSD said it was not aware of vulnerable base-system applications in that category. Independent technical write-ups tied the flaw to **`svc_rpc_gss_validate`** in the RPC/NFS path, describing how a crafted **RPCSEC_GSS** credential length can overflow a 128-byte stack buffer and potentially corrupt saved control data, leading to denial of service or kernel-mode remote code execution. The reports said the issue is reachable over the network, commonly via NFS on **TCP port 2049**, and could result in full system compromise if exploited successfully. FreeBSD released patches for supported stable and release branches and said there is no practical workaround beyond avoiding deployments where **`kgssapi.ko`** is loaded.
Jun 29, 2026
FreeBSD released security updates for **22 vulnerabilities** across the operating system, including multiple flaws that could lead to **remote code execution**, **local privilege escalation to root**, **denial of service**, **memory corruption**, and **information disclosure**. The most severe issue, **`CVE-2026-49420`**, affects `libalias`, where improper handling of **RTSP** traffic during NAT processing can allow **remote code execution as root** on systems using **`ipfw` NAT** or **`natd`**. The fixes were shipped in **FreeBSD 15.1-RELEASE-p1**, **15.0-RELEASE-p11**, **14.4-RELEASE-p7**, and **14.3-RELEASE-p16**. Additional patched components include `execve`, **Jail**, **OpenZFS**, **Linuxulator**, **KTLS**, `sound`, `vt`, `ptrace`, IPv6 multicast filtering, `tcp_rack`, `compat32`, `iconv`, and pathname resolution protections such as **`AT_RESOLVE_BENEATH`**, with the advisory noting that **13 of the issues** could enable privilege escalation to root.
Jul 7, 2026