certctl: Enforce 0444 mode on new files
When writing to a file, call fchmod() to ensure the file mode matches
the intended mode, which is 0444. This was already done when replacing
an existing file, but not when creating a new file, which meant if the
process umask was 077, the resulting certificates and bundle would be
unreadable by unprivileged users.
MFC after: 1 week
Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D58304
(cherry picked from commit 02f174179a538f89185d275b4e64277baf3acc50)
ktls: Propagate EPG_FLAG_ANON to mapped mbufs
Otherwise ktls_mbuf_crypto_state() will reject mbufs created by
_mb_unmapped_to_ext(), which arises when transmitting packets through an
interface that doesn't support unmapped mbufs, and the loopback
interface in particular.
PR: 296498
Fixes: 3444414cb463 ("ktls: Don't attempt to modify non-anonymous mbufs on the receive path")
Reviewed by: gallatin, jhb
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57557
sdhci: don't infer a non-removable slot on Apollo Lake SDXC
Intel Apollo Lake SDXC controller reports a Slot Type of
"Embedded Slot for One Device" in SDHCI_CAPABILITIES bits, even
when the slot is a removable card reader.
This caused 48 timeouts before the boot sequence resumed.
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D58467
git-arc: Make git arc patch -r smarter
- Make it work even when git arc isn't run from the root of the repo.
- If the patch fails to apply, let git partially apply the patch and
generate rej files for inspection.
While here, remove the return value from apply_rev(), it's never
actually used.
Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D58532
wg(4): Add a test that the driver handles a decryption failure
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
coredump: Don't assume that the number of ELF segments is consistent
In an ELF coredump, each dumped vm_map_entry is represented by a
segment. __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.
each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls. If the map is shared with another
process, via rfork(), then the map can change. cb_put_phdr() did not
account for this, and so could write out of bounds.
Add a check to prevent this; simply do not write out excess segments.
Approved by: so
Security: FreeBSD-SA-26:55.elf
Security: CVE-2026-58088
Reported by: Maik Muench of Secfault Security
[3 lines not shown]
wg(4): Check for crypto operation errors
In particular, handle authentication errors due to bad MACs when
decrypting packets.
Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous. Software sessions are always synchronous in practice, so
this should be a nop.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)
These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock. A comment explains why this is (probably) safe. Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped. This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.
Replace the assertions with runtime checks.
Approved by: so
Security: FreeBSD-SA-26:54.sysvsem
Security: CVE-2026-58087
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58421
coredump: Don't assume that the number of ELF segments is consistent
In an ELF coredump, each dumped vm_map_entry is represented by a
segment. __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.
each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls. If the map is shared with another
process, via rfork(), then the map can change. cb_put_phdr() did not
account for this, and so could write out of bounds.
Add a check to prevent this; simply do not write out excess segments.
Approved by: so
Security: FreeBSD-SA-26:55.elf
Security: CVE-2026-58088
Reported by: Maik Muench of Secfault Security
[3 lines not shown]
kqueue: Avoid enqueuing an already-enqueued knote
knotes with a non-trivial f_copy implementation may be activated before
kqueue_fork_copy_knote() is finished. In particular, it may be enqueued
at the time that kqueue_fork_copy_knote() calls knote_enqueue(). Guard
against this.
Add a test case which triggers the race.
Fix several other problems with the replication of knote state:
- Make sure only the KN_ACTIVE and KN_DISABLED status flags are
inherited, the rest should not be copied.
- Ignore marker knotes.
- Ignore knotes for kqueues. They cannot be safely copied into the
child without more work, as kqueues are inherently local to a process;
on fork, we need to ensure that such knotes are patched to reference
the new kqueue, not the original.
- Try to keep knote state stable by holding the kqueue and knlist locks
while copying.
[8 lines not shown]
sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)
These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock. A comment explains why this is (probably) safe. Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped. This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.
Replace the assertions with runtime checks.
Approved by: so
Security: FreeBSD-SA-26:54.sysvsem
Security: CVE-2026-58087
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58421
wg(4): Check for crypto operation errors
In particular, handle authentication errors due to bad MACs when
decrypting packets.
Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous. Software sessions are always synchronous in practice, so
this should be a nop.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
jail: restore ktrace privileges for jailed root
Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to
be configured in a jail") removed the #if 0 around the audit cases
in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under
them. This unintentionally captured the preceding case PRIV_KTRACE,
which used to fall through the disabled block into the unconditional
return (0) of the credential cases: since then, jailed root only has
ktrace privileges (tracing processes with changed credentials, see
ktrcanset()) when the unrelated allow.setaudit knob is enabled, and
conversely gains them when that audit knob is turned on.
Give PRIV_KTRACE back its own unconditional return (0), matching its
comment and the pre-4be491e1b9b3 behaviour.
Approved by: so
Security: FreeBSD-SA-26:53.ktrace
Security: CVE-2026-58086
Fixes: 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail")
[2 lines not shown]
wg(4): Add a test that the driver handles a decryption failure
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
coredump: Don't assume that the number of ELF segments is consistent
In an ELF coredump, each dumped vm_map_entry is represented by a
segment. __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.
each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls. If the map is shared with another
process, via rfork(), then the map can change. cb_put_phdr() did not
account for this, and so could write out of bounds.
Add a check to prevent this; simply do not write out excess segments.
Approved by: so
Security: FreeBSD-SA-26:55.elf
Security: CVE-2026-58088
Reported by: Maik Muench of Secfault Security
[3 lines not shown]
sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)
These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock. A comment explains why this is (probably) safe. Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped. This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.
Replace the assertions with runtime checks.
Approved by: so
Security: FreeBSD-SA-26:54.sysvsem
Security: CVE-2026-58087
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58421
wg(4): Check for crypto operation errors
In particular, handle authentication errors due to bad MACs when
decrypting packets.
Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous. Software sessions are always synchronous in practice, so
this should be a nop.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
kqueue: Avoid enqueuing an already-enqueued knote
knotes with a non-trivial f_copy implementation may be activated before
kqueue_fork_copy_knote() is finished. In particular, it may be enqueued
at the time that kqueue_fork_copy_knote() calls knote_enqueue(). Guard
against this.
Add a test case which triggers the race.
Fix several other problems with the replication of knote state:
- Make sure only the KN_ACTIVE and KN_DISABLED status flags are
inherited, the rest should not be copied.
- Ignore marker knotes.
- Ignore knotes for kqueues. They cannot be safely copied into the
child without more work, as kqueues are inherently local to a process;
on fork, we need to ensure that such knotes are patched to reference
the new kqueue, not the original.
- Try to keep knote state stable by holding the kqueue and knlist locks
while copying.
[8 lines not shown]
jail: restore ktrace privileges for jailed root
Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to
be configured in a jail") removed the #if 0 around the audit cases
in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under
them. This unintentionally captured the preceding case PRIV_KTRACE,
which used to fall through the disabled block into the unconditional
return (0) of the credential cases: since then, jailed root only has
ktrace privileges (tracing processes with changed credentials, see
ktrcanset()) when the unrelated allow.setaudit knob is enabled, and
conversely gains them when that audit knob is turned on.
Give PRIV_KTRACE back its own unconditional return (0), matching its
comment and the pre-4be491e1b9b3 behaviour.
Approved by: so
Security: FreeBSD-SA-26:53.ktrace
Security: CVE-2026-58086
Fixes: 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail")
[2 lines not shown]
wg(4): Add a test that the driver handles a decryption failure
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
boot0cfg: Also allow a file as a trailing argument
Modify the disk check to allow arbitrary files as the trailing argument
instead of requiring a live GEOM disk provider.
This enables modifying a boot0 binary file in-place before flashing it
to a disk via gpart bootcode, or using it directly as an argument to
mkimg's partition specification, as these tools cannot directly adjust
the parameters of the boot0 boot manager.
Reviewed by: imp, jhb
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57310
