security/krb5-122: Update to 1.22.3
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
application servers, were it not for the two bugs noted above.
* Check for the lockdown_keys attribute when processing password
[45 lines not shown]
check_leftovers: Tee the mtree data to stderr.
Some modifications are not obvious without seeing the mtree output,
such as changed mode/perm on a file or dir.
tests/sys/capsicum: Fix -Wshadow issue with `fd_set`
`fd_set` is defined in `sys/select.h`, and prior to this change, was in fcntl.cc as well.
This change renames `fd_set` to `fd_set_` to avoid the name collision.
MFC after: 1 week
Reported by: gcc 14
Fixes: 04c4b2084eb9 ("capsicum-test: make the code WARNS=6 clean")
krb5: Import MIT 1.22.3
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
application servers, were it not for the two bugs noted above.
* Check for the lockdown_keys attribute when processing password
[44 lines not shown]
mqueuefs: set *a_eofflag in VOP_READDIR
mqfs_readdir() never reported end of directory. Since 77b273d8f5f4
VOP_READDIR_APV() asserts that a readdir which returns no entries also
sets *a_eofflag, so with INVARIANTS the final zero-length
getdirentries(2) that ls(1) issues on a mounted mqueuefs panics:
panic: VOP_READDIR: eofflag not set
Report end of directory when the child list was walked to its end;
leave the flag clear when the walk stopped because the buffer was full.
(cherry picked from commit fbac0abdc5ab1fe867ac85635662ef06b2ee9d10)
i2ctinyusb: do not list i2ctinyusb.c twice in SRCS
The module Makefile named its only source file in both the SRCS= line
and the SRCS+= line that follows. bsd.kmod.mk tolerates the duplicate
in a normal build, but when the kernel is built with -flto=thin the
linker sees the same bitcode object twice and refuses to link the
module ("Expected at most one ThinLTO module per bitcode file").
Fixes: 54e231b373ef
(cherry picked from commit b5cd411af6418986fa0da9c12d02b9f26c344a4a)
tools/git/arcgit: retire
This too has been superseded by `git-arc`, located in the same directory as
`arcgit`.
Differential Revision: https://reviews.freebsd.org/D61379
tools/git/ghpr: retire
The project under the .../ghpr subdirectory is an earlier version of the
tool. A newer/supported iteration of the tool can be found on
[GitHub][ghpr-repo].
`ghpr` can be installed via `pkg`, e.g., `pkg install py312-ghpr-5`.
Please see the [README.md][readme] for further details.
MFC after: 1 month
[ghpr-repo]: https://github.com/bsdimp/ghpr/
[readme]: https://github.com/bsdimp/ghpr/blob/main/README.md
Reviewed by: dteske
Differential Revision: https://reviews.freebsd.org/D61086
