This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-58094.

This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-58093.

This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-58093.

This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-58094.

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.

An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.

A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.

The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.

A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic.

A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

renameat(2) did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

kqueueforkcopyknote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.

An unprivileged local user may be able to exploit these races to escalate privileges.

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.

An unprivileged local user may be able to exploit these races to escalate privileges.

When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds.

An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

End of life: 6/30/2027

The AI industry is running a contradiction it hasn’t resolved.

Frontier labs are warning about an imminent software security collapse. Anthropic reported that Claude Mythos found zero-days in codebases hardened by decades of review: a 27-year-old denial-of-service bug in OpenBSD’s TCP SACK implementation, and a 17-year-old remote code execution flaw in FreeBSD’s NFS server that hands an unauthenticated user root (CVE-2026-4747). Mozilla, testing Mythos Preview against Firefox 150, surfaced 271 vulnerabilities, more than ten times what it found in Firefox 148 using Claude Opus 4.6. OpenAI is sounding the exact same alarm, touting GPT-6 Astra saturating ExploitBench while warning that autonomous attack capabilities are scaling faster than human defenders can patch.

To be fair, Anthropic acted on part of this. Project Glasswing puts $100M in credits behind partnerships with Microsoft, Apple, CrowdStrike, and the Linux Foundation.

Glasswing makes sense for foundational open-source packages and mega-cap infrastructure. It does nothing for the other 99% of software developers. The startups, the internal tool builders, and the mid-market engineering teams writing the proprietary software that runs the rest of the world don’t have an organizational sponsor. Yet they are expected to hold off machine-speed exploits without access to the intelligence that found them.

What they get instead are models like Claude Fable or public endpoints of Astra, sitting behind hair-trigger safety classifiers and preemptive capability caps.

Labs are terrified of prompt injection and “I’m an authorized pen tester” jailbreaks, so the filters cast an absurdly wide net. Paste in complex code and ask the model to trace an execution path, analyze memory corruption, or check whether untrusted input can reach a sensitive sink, and the classifier fires immediately.

Security researchers have already documented Claude Code blocking vulnerability work outright, throwing errors about “violative cyber content” that contaminate the entire session and spread to benign follow-up questions. Worse, when the classifier flags an inquiry as security-related, it quietly routes the work to Opus. Opus handles the analysis, and you get degraded work compared to what Fable would have delivered.

Anthropic built Mythos as a model tier above Opus and published what that difference looks like in practice: ten times the findings on comparable Firefox releases.

So when Opus finishes auditing your code and reports nothing exploitable, what have you actually learned? Only that there are no bugs an Opus-class model can find. Anthropic’s own numbers prove that is a fraction of what is actually there. You haven’t verified your code is secure; you’ve verified it survived a search one tier below the frontier, and you were never told the search happened at that tier.

That ceiling won’t hold. Every audit that passes at the Opus level is a bet that nothing Mythos or Astra-class will ever be pointed at your attack surface. But frontier engines already exist, and ablated open-weight models in agentic loops are rapidly converging on the exact same workflows, without a classifier deciding which tier is appropriate for them. On a long enough timeline, that bet is guaranteed to lose.

The gatekeeping rests on a misunderstanding of how software security actually works.

Defense is downstream of offense. You cannot verify a fix you cannot attack. A scanner that lists 300 theoretical warnings without the ability to chain an exploit path is useless. It just breeds alert fatigue. Real remediation means proving the vector is reachable, building the proof of concept, shipping the patch, and running the exploit again to confirm the vector is dead.

Neuter the model’s offensive reasoning, and you neuter the audit.

Meanwhile, nobody attacking your systems is applying to Project Glasswing or arguing with commercial API guardrails.

They run local open-weight models: ablated, fine-tuned on exploit repositories, with the guardrails stripped out. Open weights still trail closed frontier models on raw benchmarks, but benchmark scores don’t decide an engagement. An attacker doesn’t need one omniscient model. They just need uncensored weights in an agentic loop with a fuzzing harness behind it, and no safety classifier killing the context window on attempt four hundred.

That leaves three distinct tiers:

Incumbents, who get vetted private access to the frontier tier through closed programs like Glasswing. The 99% of developers, who get models like Fable or Astra that trip alarms, refuse prompts, or quietly hand security work down to lower tiers without telling anyone. Attackers, who get unconstrained offensive intelligence pointed straight at the attack surface, running at machine speed.

Telling developers a cyber tsunami is coming while confiscating their lifeboats is not responsible stewardship. It is security theater. If the labs believe machine-speed cyber warfare is already here, throttling the people trying to inspect their own code is a strange way to act on that belief. Give everyday builders the same offensive firepower and let them tear their own systems apart before someone else does.

Originally posted at: https://eddiemissri.substack.com/p/the-asymmetric-disarmament-of-ai

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.

An unprivileged local user can exploit this race to escalate privileges.

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session.

An unprivileged local user can exploit this race condition to escalate privileges.

mpSetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.

A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write.

A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

mpEnddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer.

A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.

One function, groupisprimary(), was not properly updated as a part of this transition. This function is used by macdo to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.

As a result, with certain macdo rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential's supplementary group array.

If the list of supplementary groups is empty, this value will be 0, corresponding to the "wheel" group. For example, a rule such as "uid=1001>uid=1002" can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.

Certain macdo rules can be abused to set a process' group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset "uid=1001>uid=1002", the user must have user ID 1001 in order to trigger the bug.

Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the credential's first supplementary group ID as its primary group ID. Processes must explicitly remove themselves from all supplementary groups, using the privileged setgroups(2) system call, in order to exploit the bug to set 0 as the primary group ID.

Since membership in group 0 is often used to enable controlled privilege escalation, the bug might be further exploitable to obtain root privileges, depending on the system configuration. For instance, a ruleset such as the following could be exploited by a process running as user 1001 and with an empty supplementary group list: "uid=1001>uid=1002;gid=0>uid=0".

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.

On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer.

An unprivileged local user can exploit this use-after-free to escalate privileges.

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly.

An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer.

An unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation.