krb5: Import MIT 1.22.3
Major changes in 1.22.3 (2026-11-09)
====================================
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
[49 lines not shown]
nvmecontrol: Mask the fields in the Format NVM command
The format command composed cdw10 by hand without masking any of
the fields and with no support for the LBAFU field. Since commit
2c41f7d8a034 the LBA format index defaulted from FLBAS can exceed
15 on an NVMe 2.0 namespace using FIDXU, and such an index would
bleed into the MSET and PI fields. An out of range index supplied
with -f for a whole-controller format was not caught either.
Build the command with nvme_admin_format_cmd(), which masks all of
the fields and encodes LBA format indexes above 15 in LBAFU, and
reject LBA format indexes greater than 63 for whole-controller
formats. Per-namespace formats already validate the index against
NLBAF.
This is the same problem that llm-postcr reported in camcontrol's
copy of this code, fixed in 3892a6453fc6; the unmasked composition
originated here (635c517ae9ca).
[7 lines not shown]
namei(9): fix two ni_startdir leaks
namei() leaks the caller's ni_startdir reference on the empty-path
ENOENT return and on namei_getpath() failure.
On ZFS with the default zfs_xattr_compat=1, an empty user-namespace
extattr name on a file that has an xattr directory leaks one reference
on that directory per call.
Reported by: llm-postcr
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61366
vn_open_cred(9): fix ni_startdir leak
vn_open_cred() returns EINVAL before calling namei() for
O_CREAT|O_EXCL|O_DIRECTORY and for O_CREAT|O_EMPTY_PATH.
That leaks an NDINIT_ATVP() start directory.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61366
libthr mutex_self_lock(): handle signals and clock steps
Relocking an owned NORMAL mutex with an absolute timeout has two issues:
- nanosleep(2) is never restarted, so any caught signal causes
an early ETIMEDOUT.
- If CLOCK_REALTIME or CLOCK_TAI are stepped backward during the sleep,
the call also returns ETIMEDOUT before the clock reaches the deadline.
The kernel already polls CPU-time clocks and handles realtime steps.
Use _thr_umtx_timedwait_uint() in a loop to handle both issues.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61381
www/authelia: update 4.39.20 → 4.39.28; add service pid file; update default service config
Service config was outdated. The new one now successfully starts the
service.
PR: 300045
Submitted by: paul.le.gauret at gmail.com (port update)
emulators/supermodel: Update 0.3a-20260726 => 0.4-20261107
Changelog:
- rchase2: Mirror and rename roms to latest MAME findings
- Add Lost World border reload input
- Rename to Sega Model Series, fix macOS build warnings, and clean up
licensing and Games.xml
- Version numbering updated
- DSB: make FIFO write index atomic
- Refactor networking code to use a single server class and outbound TCP
connection class
Commit log:
https://github.com/trzy/Supermodel/compare/v0.3a-20260726-git-b7d8acd...v0.4-20261107-git-ff92a99
PR: 300659
Sponsored by: UNIS Labs (vvd, commit patch)
security/openbsm: Update to 1.2-alpha6
This port has been stuck at 1.1-p2 since 2009 and unmaintained since
2018. Meanwhile, it has been buildable but not usable on any version
of FreeBSD since 12.0 due to ABI issues which were patched in base but
not upstream.
OpenBSM in base is currently (since 2017) at 1.2-alpha5 plus various
fixes. Recently, we upstreamed everything that hadn't yet been
upstreamed and tagged 1.2-alpha6. This allows us to update the port
to something that works and more or less matches what's in base.
* Update to 1.2-alpha6 which includes all bug fixes from base and more.
* Switch to GitHub since 1.2-alpha6 is not (yet?) available from the
TrustedBSD website.
* Mark JOBS_UNSAFE as the build system appears to have incomplete
dependency information, leading to a sequencing issue in auditdistd
[11 lines not shown]
security/openbsm: Update to 1.2-alpha6
This port has been stuck at 1.1-p2 since 2009 and unmaintained since
2018. Meanwhile, it has been buildable but not usable on any version
of FreeBSD since 12.0 due to ABI issues which were patched in base but
not upstream.
OpenBSM in base is currently (since 2017) at 1.2-alpha5 plus various
fixes. Recently, we upstreamed everything that hadn't yet been
upstreamed and tagged 1.2-alpha6. This allows us to update the port
to something that works and more or less matches what's in base.
* Update to 1.2-alpha6 which includes all bug fixes from base and more.
* Switch to GitHub since 1.2-alpha6 is not (yet?) available from the
TrustedBSD website.
* Mark JOBS_UNSAFE as the build system appears to have incomplete
dependency information, leading to a sequencing issue in auditdistd
[9 lines not shown]
bsdinstall: Set TMPDIR in pkgbase install
The FreeBSD-base repository (aka "pkgbase") is now created using 'pkg
repo -l' in order to make 'pkg rwhich' work. Unfortunately this makes
the data.pkg file considerably larger, and FreeBSD 15.2-BETA1 fails to
install using a remote repository since the installer has a small /tmp
(20 MB).
Run pkg commands with 'env TMPDIR=<chrootdir>/tmp' since the /tmp in
the system being installed is considerably larger than the tmpfs which
the installer runs with. Create <chrootdir>/tmp first so we can ensure
it has 1777 permissions.
Reviewed by: bapt
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D61380
acpi_video: dim the internal panel while the lid is closed
Register an acpi_lid_event consumer that saves the current _BQC level and
drives _BCM to the lowest level _BCL offers when the lid closes, putting
the saved level back when it opens. Only an output already classified as
an internal panel is touched, and only a level this handler dimmed is
restored, so a brightness change made while the lid was shut survives.
Disabled by default; set hw.acpi.video.lid_blank=1 to enable.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D60827
