netmap: Fix driver name handling
if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.
While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58676
(cherry picked from commit 800d5b7a8a4f5665ced0453e090f8d563366bd47)
netmap: Fix a race in kqueue registration
We need to acquire the netmap global lock earlier, to avoid racing with
the NETMAP_REQ_REGISTER ioctl handler.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58677
(cherry picked from commit 6de818285f066c6705816674c671761dc09bff90)
e1000: Identify SerDes adapters with LED blink
The generic LED on and off operations do not handle internal SerDes
media, leaving the led(4) device ineffective on my I210 fiber port.
Use the hardware blink operation for the on phase on internal SerDes.
The off phase restores the saved OEM LED configuration as before.
(cherry picked from commit 28f96cc3748fc46408cc6ab6172f09bc2182cad7)
e1000: Fix the multiqueue debug register dump
The debug routine advanced ring pointers as if rings were contiguous.
They are embedded in queue structures, so rings beyond queue zero had
the wrong stride. The bogus queue index could cause an invalid MMIO
read and panic the machine.
Index the queue arrays first and then select the embedded ring.
(cherry picked from commit 7dd826171b69a01c234ba6e9117917398ba2705e)
[LLVM][NVPTX] Add support for TMA prefetch Rubin extensions (#217630)
This change adds support for the following operations:
1. Bulk prefetch intrinsic with eviction-priority policies (evict_normal
and evict_last).
2. Tensor prefetch intrinsics with eviction-priority policies, including
applicable override variants.
3. Tensor prefetch override intrinsics with optional cache hints.
4. Bulk applypriority intrinsic with the evict_normal policy.
5. Tensor applypriority intrinsics with the evict_normal policy,
including applicable override variants.
posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
The check for whether shm_lp_psind was assigned was unlocked. This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated. This in turn can be used to
escalate privileges.
Fix this by acquiring the rangelock earlier. In shm_mmap_large(),
assert that we hold the rangelock. In shm_write(), annotate an unlocked
load of shm_lp_psind.
Approved by: so
Security: FreeBSD-SA-26:63.posixshm
Security: CVE-2026-58094
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59104
tty: Revalidate after dropping the tty lock in ioctl handlers
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock. After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session. This race can be exploited to escalate privileges.
TIOCSPGRP has a similar race, fix that too.
Approved by: so
Security: FreeBSD-SA-26:62.tty
Security: CVE-2026-58093
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59126
openssl: Fix multiple vulnerabilities
This is a rollup commit from upstream to fix:
Handle signature_algorithms_cert extension in key-only context
Avoid double free of qrx in port_default_packet_handler()
Avoid full read buffer allocation when buffering DTLS next-epoch records
ssl/record/methods/dtls_meth.c: lower the unprocessed_rcds queue limit
ssl/record: remove dead DTLS processed_rcds record queue
Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
CMP unexpected sender DN used as format string in ERR_raise_data()
Add test for CVE-2026-63073
Add a test for restricting growth in cmp cert cache
Fix unbounded cert cache growth in cmp
Don't store ACK-only frames in TX history for QUIC.
Add test for CVE-2026-63076
Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg
Approved by: so
Obtained from: OpenSSL
[8 lines not shown]
ppp: Reject invalid endpoint discriminator options
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
Approved by: so
Security: FreeBSD-SA-26:60.ppp
Security: CVE-2026-58096
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
(cherry picked from commit b9d07a4308226b683b64827e0aaed1180e0da996)
(cherry picked from commit 30b4bdd451ad4ec2470f9a378bd62e948a85ef81)
ppp: Avoid overflow when formatting endpoint discriminator options
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have. Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.
Approved by: so
Security: FreeBSD-SA-26:60.ppp
Security: CVE-2026-58095
Reported by: Joshua Rogers <joshua at joshua.hu>
Tested by: Décio Brandão (0xDBJ)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58555
(cherry picked from commit e004ff15f87e6aa8f2aa13cd5600ae13457b95f1)
(cherry picked from commit 607c41d8f869243db275a6b1bd6cc66bf58d0f36)
cred: Fix group_is_primary()
This helper wasn't updated in commit be1f7435ef21, so in reality it was
testing whether "gid" is the first supplemental group. If a user
doesn't belong to a supplementary group, then it's testing an
uninitialized slot; since ucreds are allocated with M_ZERO, this
typically means that we're testing gid == 0.
group_is_primary() has exactly one use, in mac_do. There, it's used to
determine whether to keep the caller's current primary groups. This
means that a rule such as gid=0>uid=0 will permit any credential with no
supplementary groups.
I believe this is mostly exploitable by daemons which have explicitly
dropped privileges and called setgroups(0, NULL); logged in users will
have a non-empty supplementary group list by virtue of having gone
through initgroups(3).
Fix group_is_primary(), and add a regression test.
[9 lines not shown]
dsp: Fix a potential use-after-free in dsp_oss_syncstart()
This function has a loop where it attempts to lock all channels in a
group. If doing so would block, it releases all locks, sleeps for a
bit, and tries again. However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.
Fix the inner loop: after waking up, break out of it unconditionally and
start everything again. I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels. Then we'd try again from the beginning and fail to
lock the channels we had already locked.
Approved by: so
Security: FreeBSD-SA-26:58.sound
Security: CVE-2026-58091
Reported by: Hazley Samsudin of GovTech CSG
Reviewed by: christos
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58912
unix: Fix some bugs in the SOCK_STREAM receive path
The main problem is with the handling of errors from unp_externalize().
It turns out that this was quite broken, and unfortunately it's easy to
trigger such errors (e.g., by setting a low per-process fd limit with
setrlimit()).
In non-peek mode, uipc_soreceive_stream_or_seqpacket() cuts a bunch of
mbufs from the head of the socket buffer, to be consumed by userspace.
When unp_externalize() returns an error, we splice the removed mbuf
chain back onto the head of the socket buffer. This is expensive, but
that's ok since such errors are rare.
The problem is that this cutting is not correctly implemented: it does
not clear the "next" pointer for the last mbuf in the chain, so it
still points to the first mbuf still resident in the socket buffer.
This means that mc_init_m() creates a chain that still includes the rest
of the socket buffer, so splicing the chain back into the socket buffer
does not work properly.
[20 lines not shown]
unix/stream: plug a corner case when control externalization failed
while peer has closed its end.
Approved by: so
Security: FreeBSD-SA-26:57.unix
Reported by: syzbot+ffcc3612ea266e36604e at syzkaller.appspotmail.com
(cherry picked from commit 4548b9f3a8167a340a5086ed51a76d932c9ab3cc)
(cherry picked from commit e7070407aa8eae85bc412b9fd80865628b69f22d)
unix/stream: fix a race with MSG_PEEK on SOCK_SEQPACKET with MSG_EOR
The pr_soreceive method first scans the buffer holding the both I/O sx(9)
and socket buffer mutex(9) and after figuring out how much needs to be
copied out drops the mutex. Since the other side may only append to the
buffer, it is safe to continue the operation holding the sx(9) only.
However, the code had a bug that it used pointer in the very last mbuf as
marker of the place where to stop. This worked both in a case when we
drain a buffer completely (marker points at NULL) and in a case when we
wanted to stop at MSG_EOR (marker points at next mbuf after MSG_EOR).
However, this pointer is not consistent after we dropped the socket buffer
mutex.
Rewrite the logic to use the data length as bounds for the copyout cycle.
Provide a test case that reproduces the race. Note that the race is very
hard to hit, thus test will pass on unmodified kernel as well. In a
virtual machine I needed to add tsleep(9) for 10 nanoseconds into the
middle of function to be able to reproduce.
[10 lines not shown]
hwpmc: Fix the execve handler
When a process execve()s, pmc_process_exec() is supposed to evaluate
whether the new image is setuid/setgid and if so, whether to detach
PMCs. This was handled by pmc_can_attach(), which is effectively an
open-coded copy of cr_xids_subset().
Unfortunately, the test of the result of this function was inverted,
with the result that we'd detach PMCs only if the predicate said it was
okay to do so. It appears the bug has always been there; it seems the
intent was to return 0 on "success", i.e., it is okay to attach the
PMCs, much like p_candebug(). Commits 1c3c698ba4c4 and 1c40b15971f0
obscured this a bit.
I think this check is trying to be too clever. Let's make it simpler:
simply do not attach PMCs unless the owner is privileged. This is how,
e.g., ktrace works. I do not think it's worth trying to be more
sophisticated than this unless we can generalize the policy in a way
that's applicable to other subsystems.
[11 lines not shown]
ucode: Fix validation on Intel platforms
The check for the extended signature table was backwards, so we always
ignored it.
We should verify that the extended signature table fits within the total
image size.
Approved by: so
Security: FreeBSD-EN-26:20.microcode
Reviewed by: jrm, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57209
(cherry picked from commit 0beb172898499fff51eed4df3d9284cd1094afbb)
(cherry picked from commit 2a1eaaf331f7935b3febbb863e1c892670030b8e)
ppp: Reject invalid endpoint discriminator options
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
Approved by: so
Security: FreeBSD-SA-26:60.ppp
Security: CVE-2026-58096
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
(cherry picked from commit b9d07a4308226b683b64827e0aaed1180e0da996)
(cherry picked from commit 30b4bdd451ad4ec2470f9a378bd62e948a85ef81)
ppp: Avoid overflow when formatting endpoint discriminator options
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have. Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.
Approved by: so
Security: FreeBSD-SA-26:60.ppp
Security: CVE-2026-58095
Reported by: Joshua Rogers <joshua at joshua.hu>
Tested by: Décio Brandão (0xDBJ)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58555
(cherry picked from commit e004ff15f87e6aa8f2aa13cd5600ae13457b95f1)
(cherry picked from commit 607c41d8f869243db275a6b1bd6cc66bf58d0f36)
hwpmc: On attach, ensure owner is a target effective GID's member
This restores a check that existed prior to commit be1f7435ef218b1d
("kern: start tracking cr_gid outside of cr_groups[]").
While here, improve pmc_can_attach()'s style by changing the type of
'decline_attach' to 'bool', fixing tests on it, adding missing
parentheses to 'return' statements, and by changing its return value
type to 'bool'.
Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
MFC after: 9 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52252
(cherry picked from commit 1c3c698ba4c40485ebbbd157cb49172cfa7de9b2)
MFC to 14 does not fix any bug, but just applies some style changes
needed by next MFC.
[6 lines not shown]
tty: Revalidate after dropping the tty lock in ioctl handlers
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock. After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session. This race can be exploited to escalate privileges.
TIOCSPGRP has a similar race, fix that too.
Approved by: so
Security: FreeBSD-SA-26:62.tty
Security: CVE-2026-58093
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59126
posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
The check for whether shm_lp_psind was assigned was unlocked. This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated. This in turn can be used to
escalate privileges.
Fix this by acquiring the rangelock earlier. In shm_mmap_large(),
assert that we hold the rangelock. In shm_write(), annotate an unlocked
load of shm_lp_psind.
Approved by: so
Security: FreeBSD-SA-26:63.posixshm
Security: CVE-2026-58094
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59104
hwpmc: On attach, fix allowing a PMC's owner to attach it to itself
The returned value in this case was wrong, and would basically prevent
some PMC's owner process to attach that PMC to itself although the
security checks underneath would have allowed it.
Now that this early return has been fixed, its block basically becomes
a performance short-circuit which has no effect from a functional
standpoint.
Fixes: ebccf1e3a6b1 ("Bring a working snapshot of hwpmc(4), ...")
MFC after: 9 days
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1c40b15971f09c0c0676ae476b88b32166eae8ac)
openssl: Fix multiple vulnerabilities
This is a rollup commit from upstream to fix:
Avoid full read buffer allocation when buffering DTLS records
ssl/record: lower the DTLS unprocessed_rcds queue limit
Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
Add a test for restricting growth in cmp cert cache
Fix unbounded cert cache growth in cmp
Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg
Approved by: so
Obtained from: OpenSSL
Security: FreeBSD-SA-26:61.openssl
Security: CVE-2026-54874
Security: CVE-2026-63072
Security: CVE-2026-63074
Security: CVE-2026-63076
