FreeBSD 15.1-RELEASE Errata
Abstract
This document lists errata items for FreeBSD 15.1-RELEASE, containing significant information discovered after the release or too late in the release cycle to be otherwise included in the release documentation. This information includes security advisories, as well as news relating to the software or documentation that could affect its operation or usability. An up-to-date version of this document should always be consulted before installing this version of FreeBSD.
This errata document for FreeBSD 15.1-RELEASE will be maintained until the release of FreeBSD 15.2-RELEASE.
Table of Contents
Introduction
This errata document contains "late-breaking news" about FreeBSD 15.1-RELEASE. Before installing this version, it is important to consult this document to learn about any post-release discoveries or problems that may already have been found and fixed.
Any version of this errata document actually distributed with the release (for example, on a CDROM distribution) will be out of date by definition, but other copies are kept updated on the Internet and should be consulted as the "current errata" for this release. These other copies of the errata are located at https://www.FreeBSD.org/releases/, plus any sites which keep up-to-date mirrors of this location.
Source and binary snapshots of FreeBSD 15-STABLE also contain up-to-date copies of this document (as of the time of the snapshot).
For a list of all FreeBSD CERT security advisories, see https://www.FreeBSD.org/security/.
Security Advisories
| Advisory | Date | Topic |
|---|---|---|
30 June 2026 |
Use-after-free in device pager page list |
|
30 June 2026 |
Jail reference count underflow |
|
30 June 2026 |
Local privilege escalation via execve(2) TOCTOU race |
|
30 June 2026 |
Multiple vulnerabilities in OpenZFS |
|
30 June 2026 |
Buffer overflow in libalias RTSP handler |
|
30 June 2026 |
unlinkat(2) ignores AT_RESOLVE_BENEATH flag |
|
30 June 2026 |
Use-after-free in TCP RACK stack option handler |
|
30 June 2026 |
Multiple vulnerabilities in POSIX largepage objects |
|
30 June 2026 |
Incorrect audit records for ptrace(2) syscall requests |
|
30 June 2026 |
Remote DOS via uninitialized memory access in KTLS receive |
|
30 June 2026 |
Multiple vulnerabilities in iconv(3) |
|
29 July 2026 |
Use-after-free in kqueue copy-on-fork |
|
29 July 2026 |
Kernel stack disclosure via timer_settime(2) |
|
29 July 2026 |
Missing MAC validation in wg(4) packet decryption |
|
29 July 2026 |
ktrace(2) privilege incorrectly validated in jails |
|
29 July 2026 |
Heap out-of-bounds access in semctl(2) |
|
29 July 2026 |
Race condition in ELF core dump segment counting |
|
25 August 2026 |
hwpmc fails to detach PMCs during exec credential transitions |
|
25 August 2026 |
Use-after-free in unix SOCK_STREAM message handling |
|
25 August 2026 |
Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl |
|
25 August 2026 |
Unauthorized credential switching |
|
25 August 2026 |
Multiple vulnerabilities in ppp(8) |
|
25 August 2026 |
Multiple vulnerabilities in OpenSSL |
|
25 August 2026 |
Kernel use-after-free via tty ioctls |
|
25 August 2026 |
TOCTOU race in POSIX shared memory large page configuration |
|
29 September 2026 |
Heap out-of-bounds access in semop(2) |
|
29 September 2026 |
Memory safety bugs in kqueue copy-on-fork implementation |
|
29 September 2026 |
Multiple jail filesystem root escapes |
|
29 September 2026 |
Remote DoS via receive-side kernel TLS |
|
29 September 2026 |
Out-of-bounds read in OpenSSL DTLS retransmission |
|
29 September 2026 |
IPv6 UDP sendto(2) bypasses jail loopback restriction |
Errata Notices
| Errata | Date | Topic |
|---|---|---|
30 June 2026 |
32-bit setcontext(2) and swapcontext(2) fail on arm64 |
|
30 June 2026 |
Socket refcount underflow in the NFS server |
|
29 July 2026 |
Timezone database information update |
|
29 July 2026 |
Race conditions in zvol device management |
|
25 August 2026 |
Early loading of Intel CPU microcode fails for some CPUs |
|
29 September 2026 |
syslogd(8) leaks child processes when logging to a pipe |
|
29 September 2026 |
Timezone database information update |
Open Issues
-
The nfs(4) client may cause a kernel panic when an NFSv4.1 or NFSv4.2 server becomes unresponsive or reboots. The system will automatically reboot after the panic.
Workaround: Avoid usingsoftorintrmount options with NFSv4.1/4.2 mounts. If the panic occurs frequently, consider downgrading to NFSv3 until a patched version is available.
State: Fixed in 15-STABLE after 26 June 2026 - https://bugs.freebsd.org/294925 -
Systems with zfs(4) encrypted pools with
keylocation=promptdatasets may stall waiting for a passphrase on boot if thezfskeysrc(8) script is enabled, diverging from previous behavior where mounting them would be skipped.
Workaround: Usezpool set cachefile=none <pool>so that the pool is not imported at boot.
State: Fixed in 15-STABLE after 24 August 2026 - https://bugs.freebsd.org/296130
Late-Breaking News
No late-breaking news.
Last modified on: September 30, 2026 by Philip Paeps