Month: June 2026

This has been one of the most eventful weeks in recent FreeBSD history: a new release, a new Core Team, a graphics driver milestone, and a proposal to overhaul the service manager. Here’s the roundup.

FreeBSD 15.1-RELEASE Is Here

The biggest news of the week: FreeBSD 15.1-RELEASE was announced on June 16 – the second release of the stable/15 branch. The release was originally planned earlier but delayed by two weeks.

Highlights include:

• WiFi drivers now based on Linux v7.0 (iwlwifi and other LinuxKPI-based drivers)
• Boot-time scheduler selection via kern.sched.name tunable
• C23 progress: significant strides toward complete C23 language support
• Unicode 17.0.0 with 4,803 new characters and CLDR 48
• Cloud images with pkgbase now include pkg(8) and support automatic base system package updates on first boot
• OpenZFS 2.4.2 and OpenSSL 3.5.6
• Intel LASS support (Linear Address Space Separation) on AMD64
• DTrace on 32-bit PowerPC and PowerPC64LE
• The release is dedicated to the memory of Peter G. Neumann, a longtime collaborator on capability-based security

The release notes also include numerous base system changes: find(1) now supports -xattr and -xattrname, bectl(8) can create empty boot environments (-E), cron(8) gains full PAM session lifecycle support, and the default root shell has changed from csh to sh.

New Core Team (core.14) Elected

On June 24, the 2026 FreeBSD Core Team election results were announced. The nine elected members of the fourteenth Core Team are:

• Warner Losh (imp)
• Baptiste Daroussin (bapt)
• Gleb Smirnoff (glebius)
• Kyle Evans (kevans)
• Adrian Chadd (adrian)
• Joseph Mingrone (jrm)
• Hiroki Sato (hrs)
• Adam Weinberger (adamw)
• Olivier Cochard (olivier)

A bylaws amendment was also passed, tentatively taking effect with the 2028 election at the new core team’s discretion. The transition plan will be shared soon.

Outgoing core.13 members: Li-Wen Hsu, Allan Jude, Tobias C. Berner, Dave Cottlehuber, and Mathieu Arnold. Dag-Erling Smørgrav ran a flawless election.

Graphics Port Upgraded to Linux 6.12

The FreeBSD Foundation announced on June 16 that the drm-kmod port now includes the Linux 6.12 LTS graphics driver. This update brings:

• Better compatibility with modern AMD Radeon and Intel graphics hardware
• Improved Wayland compatibility
• Enhanced graphics stability and security
• Linux 6.12 is a CIP SLTS kernel (Super Long Term Support through 2036)

The update requires FreeBSD 15.1 or later.

FreeBSD 14.3 Reaches End-of-Life

The FreeBSD Security Officer announced on June 20 that FreeBSD 14.3 reaches end-of-life on June 30, 2026, after which it will no longer receive security support. Users should upgrade immediately.

After June 30, the supported branches and releases are:

rcd(8) – A New Service Manager for FreeBSD

On June 14, Baptiste Daroussin opened a discussion on freebsd-hackers about rcd(8), a new service manager daemon he’s been working on for years. The discussion continued throughout this week.

Key features:

• Parallel boot via dependency DAG (no more serial rc.d execution)
• Process tracking via pdfork(2) descriptors (no PID file races)
• Subreaper via procctl(2) (no orphaned process escape)
• Socket activation (pre-bound sockets passed via fd inheritance)
• Resource control per service via rctl(2)
• Service isolation via native jail(2) integration
• OOM protection via procctl(2) PROC_SPROTECT
• UCL-based unit files (JSON Schema validated)
• Embedded Lua interpreter for inline service hooks
• Template units for per-instance services (e.g., dhclient@em0)
• Safe in-place binary upgrade (SIGUSR1: save state, re-exec)

User interface: rcctl(8), familiar from OpenBSD but with FreeBSD-specific implementation.

100% backward compatibility is a hard requirement. rcd scans existing rc.d scripts, parses their PROVIDE/REQUIRE/BEFORE/KEYWORD headers, reads rc.conf, and wraps each script as a virtual “legacy” unit. The migration path is gradual: rc.d scripts will be converted to native UCL unit files at each maintainer’s pace, with no deadline.

The mailing list discussion was intense, with comparisons to launchd and debates over compatibility, daemon supervision, and the migration path.

OpenZFS Merge and ZFS Improvements

On June 27, the OpenZFS merge (commit d0b3ecd) was integrated into the FreeBSD main branch. The change spans +6,983/-2,497 lines across 161 files, pulling in upstream PRs including #18509.

Additionally, on June 25, zfsd spare selection was improved (commit 6aaaf7b), porting OpenZFS PRs #18597 and #18578 from zed to zfsd. Spare selection now considers optimal spare distribution across pools.

pkgbasify – Making the Switch to pkgbase Easy

On June 24, Dag-Erling Smørgrav (des) published a blog post showing how to convert a FreeBSD 15 system to packaged base (pkgbase) with a single command:

# pkg install -r FreeBSD-base --register-only FreeBSD-set-{base,lib32,kernels}{,-dbg} FreeBSD-set-{src,tests}

He walks through enabling the FreeBSD-base repository, creating a boot environment, and notes minor issues like pkg leaf not accounting for shared library dependencies.

AI-assisted Vulnerability Discovery: Praetorian Finds 8 Kernel Bugs

Praetorian published a detailed blog post on June 17 describing how their team used Claude Opus 4.6 and Claude Code to find eight FreeBSD kernel vulnerabilities – including CVE-2026-3038, a stack overflow enabling jail escapes. This underscores the significance of the FreeBSD Foundation’s AI-assisted Vulnerability Discovery Project, launched June 15 with $250k funding from Alpha Omega.

Security Advisories (9 Advisories, June 9)

While these advisories originated in the previous week, they remain relevant:

All advisories affect FreeBSD 14.x and 15.x. Users should run freebsd-update immediately.

Other Developments

• OFED update (June 24): Various changes from Linux 4.17 merged into the InfiniBand/driver code
• ng_socket leak fixed (June 26): Gleb Smirnoff closed a node reference leak in ng_socket
• cpufreq format fix (June 25): Fix for incorrect formatting, contributed at the Halifax Hackathon
• BSD Now 669 (June 26): Covered native inotify support in FreeBSD and Poudriere optimization
• Vermaden’s Valuable News (June 22): Comprehensive weekly roundup with many FreeBSD links
• Klara Systems: Articles on native inotify in FreeBSD and ZFS performance without hardware upgrades

Bottom Line

Week 26 was one of the densest in recent memory for FreeBSD: a new major release, a newly elected Core Team, a significant graphics driver jump, the unveiling of a new service manager proposal, and an EoL deadline for 14.3. If you’re still on 14.3, upgrade now – the clock runs out on June 30.

Links: – FreeBSD 15.1-RELEASE Announcement – Release Notes – FreeBSD Foundation Graphics Blog – New Core Team Announcement – rcd(8) Discussion – pkgbasify Blog Post – Praetorian FreeBSoD Blog – AI Vulnerability Discovery Project – FreeBSD 14.3 EoL

This week belonged to FreeBSD: the 15.1 release, a massive security advisory batch, a new AI-assisted vulnerability project, and the end-of-life announcement for 14.3 — plenty to digest.

FreeBSD 15.1-RELEASE Is Here

The big headline: on June 16, the Release Engineering Team published FreeBSD 15.1-RELEASE. A critical x86 bootloader bug had delayed it by two weeks, but the second release from the stable/15 branch is now available.

Key changes in 15.1

WiFi drivers updated to Linux 6.7/7.0 level: The LinuxKPI-based wireless drivers (iwlwifi and others) have been brought up to the Linux kernel 7.0 level, delivering significantly better compatibility with modern WiFi hardware — especially Intel chipsets and select MediaTek/Realtek devices.

C23 support progresses: The compiler and standard library have made further strides toward full C23 compliance.

Graphics drivers upgraded to Linux 6.12 (LTS): The FreeBSD Foundation announced that the drm-kmod port now includes the Linux 6.12 graphics driver, an LTS kernel with planned maintenance through 2036 (CIP program). This brings better compatibility with current AMD Radeon and Intel GPUs and improved Wayland support. Available for FreeBSD 15.1 onward.

Other notable changes in 15.1:

• OpenPAM moved to a separate FreeBSD-pam package (pkgbase)
• Zstandard/zstd(1) moved to a separate FreeBSD-zstd package
• installworld/installkernel blocked on pkgbase systems to prevent database inconsistencies
• Default shell for root and the freebsd user in release images changed from csh(1) to sh(1)
• find(1) gains -xattr and -xattrname primaries for searching by extended attributes (sponsored by Klara Systems)
• newfs(8) now prevents simultaneous GEOM journaling and soft updates; new -u flag to disable soft updates
• bectl(8) new -E flag to create empty boot environments without cloning
• zfs clone supports -u to prevent automatic mounting of new datasets
• ipfs(8) disabled by default; kernel support now optional
• New keyboard layouts: us.intl.acc.kbd and Lenovo laptop keymap for vt(4)
• diff3(1) merge mode now GNU-compatible
• pwd(1) defaults to -L (logical), following POSIX semantics

Release info: freebsd.org/releases/15.1R

Nine Security Advisories at Once

On June 9 — before the release — the Security Team published nine advisories simultaneously, several rated core with critical impact:

All advisories are patched in 15.1-RELEASE. Users on older versions should update immediately.

AI-Assisted Vulnerability Discovery Project Launched

On June 15, the FreeBSD Foundation announced the AI-assisted Vulnerability Discovery Project, funded by a $250,000 grant from the Linux Foundation’s Alpha Omega initiative (backed by Anthropic, AWS, GitHub, Google, Microsoft, and OpenAI).

Key points:

• Focus initially on the kernel, then userland and ports
• AI used for discovery and analysis only; all patches are manually crafted
• Netflix, NetApp, and Verisign supporting testing and validation
• The project responds to the flood of AI-generated vulnerability reports overwhelming the volunteer security team

Coinciding with this, Praetorian published a detailed blog post about their own AI-powered research: using Claude Code (Opus 4.6), they found eight FreeBSD kernel vulnerabilities in just days, including CVE-2026-3038 (a stack overflow in the route subsystem, already patched in SA-26:05.route). The other seven are still being processed. The post walks through their methodology — from source analysis to crash reproduction to exploit development with jail escape.

FreeBSD 14.3 Reaches End-of-Life

On June 20, the Security Team announced that FreeBSD 14.3 reaches end-of-life on June 30, 2026 — no more security patches after that. Users should upgrade to 14.4 or 15.1. The stable/14 branch will remain maintained until November 2028.

Blog Posts and Community

pkgbasify — converting to packaged base elegantly: Dag-Erling Smørgrav (blog.des.no) describes his approach to converting FreeBSD 15.1 systems from distribution sets to pkgbase with a single pkg install command. He critiques the Foundation’s official pkgbasify script and offers a more direct alternative. If you’ve been meaning to try pkgbase, this is a practical guide.

Native inotify in FreeBSD: Klara Systems published a deep dive into the limitations of EVFILT_VNODE/kqueue for file monitoring and why FreeBSD needs a native inotify implementation. The existing libinotify userspace wrapper suffers from race conditions and scalability issues — the article explains the technical details and proposes solutions.

ZFS Vendor Import: Chris Longros reports that his ZFS commits have been upstreamed into the FreeBSD tree — a small but important milestone for ongoing ZFS maintenance.

In the Source Tree

Selected commits from the past week:

• FORTIFY_SOURCE overrides: Kevans implements per-file FORTIFY_SOURCE overrides in the build system — a step toward more robust buffer checks in the base system
• rename(2): Kostik Belousov prevents renaming the root vnode of a mounted filesystem (security fix)
• renameat(2): Signal check added in retry loops
• NFS va_flags fix: Correction for the case where va_flags are being cleared
• lsof: Fix for building on 16-CURRENT (malloc.h conflict)
• APEI: More information provided on fatal hardware errors

Summary

This week was dominated by the FreeBSD 15.1 release — one that noticeably improves laptop and desktop viability (WiFi, graphics, better suspend/resume). At the same time, the flood of security advisories and the new AI vulnerability project underscore how much the threat landscape is shifting: AI tools are drastically lowering the barrier to vulnerability discovery, and FreeBSD is responding in kind. Anyone still on 14.3 needs to act by June 30 at the latest.

The Big Security Week: Nine Advisories at Once

The single most important development this week was the security advisory batch released on June 9, 2026, which brought no fewer than nine advisories — several rated core with critical impact:

The Most Severe Vulnerabilities

• SA-26:25.thr – Missing permission check in thr_kill2(2). An unprivileged local user could send signals to arbitrary processes, even across jail boundaries. Discovered by researchers at Tsinghua University using GLM-5.1 (Z.ai) — a notable case of AI-assisted security research. CVE-2026-45256
• SA-26:26.ktls – Arbitrary file overwrite via the KTLS receive path. Through KTLS decryption on non-anonymous mbufs (via sendfile(2) + loopback), a local user could overwrite file contents including setuid binaries — achieving full privilege escalation. No workaround available. CVE-2026-45257, category: core.
• SA-26:27.sound – Two mmap vulnerabilities in the sound(4) driver (CVE-2026-45258, CVE-2026-49417) allowing unprivileged local users to read/write kernel memory via /dev/dsp, enabling privilege escalation.
• SA-26:28.capsicum – sigqueue(2) lacked a Capsicum mode check, allowing sandboxed processes to send signals to other processes, bypassing Capsicum restrictions.
• SA-26:30.linux – The Linuxulator incorrectly set AT_SECURE to zero for setuid/setgid Linux binaries. Unprivileged users could inject shared libraries via LD_PRELOAD and escalate privileges.
• SA-26:29.ip6_multicast – Vulnerability in IPv6 multicast processing.
• SA-26:31.arm64 – Arm CPU errata may bypass page table permission changes. Affected models include numerous Cortex-A/Neoverse chips (A76, A77, A78, A710, X1, X2, X3, X4, N1, N2, V1, and more). No workaround. CVE-2025-10263
• SA-26:32.elf – ELF processing vulnerability.
• SA-26:35.openssl – Multiple OpenSSL vulnerabilities.

Bottom line: Anyone running FreeBSD in production should patch and reboot immediately — the ktls and thr vulnerabilities are particularly critical.

FreeBSD 15.1-RELEASE: Tomorrow, Finally!

After two unplanned release candidates, FreeBSD 15.1-RC3 was published on June 6. The only but critical fix addressed the x86 boot loader / kernel handover: the system could hang during boot, especially when Intel microcode updates were being loaded.

The RELEASE date is now set for June 16, 2026 — tomorrow, barring further delays.

What 15.1 Brings

Highlights from the release notes:

• OpenPAM and Zstandard (zstd) moved into separate pkgbase packages
• installworld/installkernel blocked on pkgbase systems to prevent package database inconsistencies
• Default shell for root and freebsd user: now sh(1) instead of csh(1)
• find(1) gains -xattr and -xattrname for extended attribute searches
• bectl(8) gains -E flag to create empty boot environments
• zfs clone gains -u to prevent automatic mounting
• newfs(8) gains -u flag to disable soft updates
• daemon(8) supports configurable file modes for log output
• diff3(1) now GNU-compatible in merge mode
• setaudit(8) added as a new utility for audit policies
• ipfs(8) disabled by default, kernel support now optional
• DTrace probes support on PowerPC architectures
• sched_ule implemented as a scheduler instance
• Updated OpenZFS support
• Oracle Cloud Infrastructure build targets removed

Graphics Drivers: drm-kmod Updated

On June 10, Jean-Sébastien Pédron (dumbbell) updated the DRM drivers in the Ports tree — commit messages indicate a version bump to Linux 6.12.85 (matching the recently released drm_v6.12.85_2). Anyone needing current Intel/AMD graphics should update their drm-*-kmod packages.

Blog Posts of the Week

“Native inotify in FreeBSD” (Klara Systems)

Klara Systems published an in-depth article on the shortcomings of the userspace inotify implementation (libinotify.so) on FreeBSD. The library translates inotify calls into kqueue/EVFILT_VNODE, which leads to sporadically missing CLOSE events. The article compares the inotify and kqueue APIs and discusses how a native kernel inotify implementation could resolve these reliability issues.

“FreeBSD Jails” (Tom’s IT Cafe, June 5)

Another contribution covering FreeBSD Jails as a container isolation technique — a classic topic that keeps getting refreshed.

Ports & Packages

• lang/libobjc2 updated to version 2.3
• kf6-*: Portlint fixes across the KDE Framework 6 series
• Ports Q2 branch (2026Q2) was created in early April and is active; the next quarterly package update is in preparation

Looking Ahead

• June 16: Scheduled RELEASE date for FreeBSD 15.1
• Q2 Status Report: The submission deadline for the FreeBSD quarterly status report (April–June) was June 14 — the report should appear in the coming weeks
• The massive security batch demonstrates that AI-assisted security research is having real-world impact (GLM-5.1 found the thr_kill2 vulnerability)

A third release candidate for FreeBSD 15.1, critical x86 bootloader bugs, a flood of AI-discovered vulnerabilities, and the Frankfurt hackathon recap – this week was packed for FreeBSD.

FreeBSD 15.1-RC3 Released – Release Pushed to Mid-June

The week’s headline event: Colin Percival announced FreeBSD 15.1-RC3 on June 6. A third release candidate was needed because a critical bug in the x86 bootloader/kernel handoff was discovered that could cause systems to hang during boot – most commonly, but not exclusively, when Intel microcode updates are being loaded.

The announcement explicitly warns: when upgrading to RC3, you must install the updated EFI bootloader. The originally planned early-June release date has slipped to mid-June.

RC2 (May 31) had already re-introduced PadLock RNG support for VIA/Zhaoxin processors and integrated security fixes from SA-26:19 through SA-26:24. RC3 builds on that with the critical bootloader fix.

Available images include amd64, powerpc64(le), armv7, aarch64 (including RPI, PINE64, ROCK64), and riscv64, plus VM images (QCOW2, VHD, VMDK, raw), OCI container images, and Amazon EC2 AMI images.

Security Advisories – AI-Driven Vulnerability Discovery Makes Its Mark

The wave of security advisories published in late May (SA-26:18 through SA-26:24) continues to dominate discussions. Notably, most of these vulnerabilities were discovered through AI-driven security research:

SA-26:18.setcred – Stack Buffer Overflow via setcred(2)

A stack buffer overflow in the new setcred(2) system call that could lead to local privilege escalation (CVE-2026-45250).

SA-26:19.file – Kernel Use-After-Free via File Descriptor Syscalls

Discovered by Calif.io. A use-after-free in the kernel through file descriptor system calls.

SA-26:20.fusefs – Heap Overflow in FUSE_LISTXATTR

Discovered by the AISLE Research Team. A heap overflow in the FUSE file system code.

SA-26:21.ptrace – Missing Validation in ptrace(PTSCREMOTE)

Found by researchers using GLM-5.1 from Z.ai. Unprivileged local users could escalate privileges to root.

SA-26:22.libcasper – select(2) FD Set Overflow → Stack Overflow

Also from the AISLE Research Team. A file descriptor set overflow in select(2) led to a stack overflow. CVE-2026-39457 and CVE-2026-39461 were assigned.

SA-26:23.bsdinstall – RCE via Wi-Fi Access Point Scans

A suitably crafted network name (SSID) could cause command execution via sub-shell during Wi-Fi scans in bsdinstall and bsdconfig.

SA-26:24.capnet – Incorrect libcapnet Permission List Manipulation

Incorrect manipulation of permission lists in libcap_net could extend a process’s permissions.

Earlier Advisory from April: SA-26:14.pf – pf Stack Overflow via SCTP

Published April 29 but relevant context for the current wave: invalid SCTP packets could trigger unbounded recursion in pf, resulting in a stack overflow and kernel panic (CVE-2026-7164).

AISLE: Three setuid-root Stack Buffer Overflows Uncovered

On May 25, the AISLE Research Team published a detailed blog post on discovering three separate stack buffer overflows in FreeBSD, all reachable through the same basic attack vector:

1. ping6: The setuid-root binary lost a safety check that the closely related ping program retained. A local user could open many file descriptors and then execute /sbin/ping6, forcing later descriptors above 1023 and reaching unchecked FD_SET() calls.
2. libnv: The same FD_SET overflow in the NV encoding library.
3. libcasper: Ironically, the bug also hit FreeBSD’s Capsicum/Casper sandboxing infrastructure, which exists specifically to contain untrusted operations.

Particularly interesting: the ping6 bug had been fixed in closely related code back in 2002, but the corresponding guard was removed during a refactoring and never restored.

Blog Posts and Articles

“An AI audit of FreeBSD” (blog.calif.io, May 28)

Calif.io published a comprehensive retrospective on their AI-driven audit campaign against FreeBSD. Result: 15 kernel bugs, including 3 Remote Code Execution (RCE), 5 Local Privilege Escalation (LPE), and 1 bhyve escape.

“CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script” (blog.calif.io, May 7)

Another Calif.io article demonstrating how a single shell script was enough to gain root access on a FreeBSD system.

AISLE: “AISLE matches Anthropic Mythos on FreeBSD zero-days” (May 6)

AISLE reports independently reproducing three of the eight FreeBSD security advisories from April 2026 that were also found by Nicholas Carlini at Anthropic (Claude Mythos).

AISLE: “AISLE Finds 21-Year-Old FreeBSD RCE Hidden in dhclient” (May 7)

CVE-2026-42511: A 21-year-old remote code execution vulnerability in dhclient, where the BOOTP file field was not properly escaped, allowing injection of arbitrary dhclient.conf directives.

Frankfurt Area FreeBSD Hackathon Recap (FreeBSD Foundation, June 2)

The FreeBSD Foundation published a recap of the first regional hackathon in the Frankfurt area (April 24–26). Results: 120 closed bug reports, successful implementation of SBOM (Software Bill of Materials) functionality, and a German translation of Sylve.

“FreeBSD May 2026 Security Batch – An Operator’s Triage Guide” (maxiujun.com)

A practical triage guide for admins: of the seven simultaneously published advisories, two are kernel-side and trivially exploitable by any local user – patch those first.

Mailing List Discussions

mtree(1) POLA Violation

Gleb Smirnoff flagged on the freebsd-current list that the recent mtree(1) import from NetBSD constitutes a POLA (Principle of Least Astonishment) violation: checksum behavior has changed. Jose Luis Duran and Xin LI discussed potential corrections; a differential (D56013) was submitted to add missing entries.

15.1 Release Planning

Mailing list activity shows the typical end-of-cycle intensity: RC1, RC2, and RC3 were each announced on freebsd-stable. The delay from additional release candidates has drawn mixed reactions – understanding of the security fixes, but also impatience for the final release.

Looking Ahead

• BSDCan 2026 and the FreeBSD Developer Summit take place June 17–18 in Ottawa, Canada.
• FreeBSD 15.1-RELEASE is expected mid-June, assuming no further critical issues surface.
• AI-driven security research (Calif.io, AISLE, Anthropic Mythos) has established itself as a serious force – expect more findings.

This was one of the most security-intensive weeks in recent FreeBSD history. Between AI-discovered vulnerabilities, a new release candidate, and the Foundation’s Executive Director daily-driving FreeBSD on a laptop, there was plenty to talk about.

FreeBSD 15.1-RC1 Released

On May 29, Colin Percival released the first release candidate for FreeBSD 15.1. RC1 includes a batch of security fixes (more below), improvements to the fwget firmware tool, and various small kernel bug fixes and man page updates.

The 15.1-RELEASE is planned for June, assuming no further surprises. The release cycle has been fairly smooth so far: BETA1 dropped on May 2, and RC1 is the latest milestone.

Download: https://download.freebsd.org/releases/ISO-IMAGES/15.1/

Security Advisories: The May 2026 Batch

On May 20, FreeBSD published seven security advisories in a single day — enough to make even seasoned operators sweat. Xiujun Ma published an excellent triage guide that I recommend every admin read.

The two most critical:

SA-26:18.setcred — Kernel-Level RCE

The setcred(2) system call copies a user-supplied list of supplementary groups into a fixed-size kernel stack buffer without checking the length. The result: a kernel stack overflow that enables arbitrary kernel-level code execution. Any local user can trigger this, no special configuration required, all supported FreeBSD versions affected. Patch immediately.

SA-26:21.ptrace — Local Privilege Escalation (CVE-2026-45253)

Insufficient parameter validation in the PT_SC_REMOTE ptrace operation allows unprivileged local users to execute arbitrary system calls inside a target process. Local → root. On multi-user boxes and jail hosts, this is also a same-day patch.

The remaining five advisories:

AI-Discovered Vulnerabilities: Calif.io and AISLE

This is the big story of the week: AI systems are now actively finding FreeBSD kernel bugs.

Calif.io — “An AI Audit of FreeBSD”

Security research firm Calif.io published a detailed blog postdescribing their AI-driven audit of the FreeBSD kernel. Within a few weeks, the AI found:

• 5 local privilege escalations
• 1 bhyve guest-to-host escape
• A handful of memory disclosures and DoS bugs

In total, 15 kernel bugs, all reported to the FreeBSD security team. Notably, Calif.io coordinated with the FreeBSD team, focused on their priorities, and only reported high/critical bugs — no CVE-chasing, just targeted help.

One of the published exploits is setcred (CVE-2026-45250): a single-character sizeof confusion in kern_setcred_copyin_supp_groups that turns into a stack overflow and then a local root shell. Only FreeBSD 14.4 is exploitable, despite the same source bug being present in 14.3 and 15.0.

AISLE — Autonomous Vulnerability Discovery

The AISLE Research Team also made waves. On May 25, they published a report on three stack buffer overflows in ping6, libnv, and libcasper — all reachable through the same fundamental mechanism: FD_SET() with file descriptors above 1023.

The ping6 bug is particularly notable: the binary runs setuid-root, meaning any local user can trigger the vulnerable path in a process with effective UID 0. Ironically, FreeBSD had already fixed this exact bug class in closely related code back in 2002 — the guard in ping6 disappeared during a later refactoring and never returned.

AISLE also discovered a 21-year-old RCE in dhclient (CVE-2026-42511) and reported that their autonomous system independently found three of the eight April security advisories — matching Anthropic’s “Claude Mythos” on capability.

Deb Goodkin Daily-Drives FreeBSD on a Framework Laptop

Deb Goodkin, the FreeBSD Foundation’s Executive Director since 2005, spoke at the Open Source Summit + ELC NA 2026 in Minneapolis about her experience daily-driving FreeBSD on a Framework Laptop. Until recently, she hadn’t been running FreeBSD as her daily OS because it “felt like a mountain.”

Her takeaways:

• Touchscreen worked out of the box
• KDE desktop ran stable
• Peripherals like a wireless mouse worked without issues
• Zoom eventually worked after some troubleshooting
• Webcam required manual setup
• Microsoft Teams only partially functional

This aligns with the Foundation’s ongoing Laptop Integration Testing Project, which aims to close the graphics and Wi-Fi driver gap with Linux in 2026.

NVIDIA Driver Update

The NVIDIA graphics driver in FreeBSD ports was updated to version 595.71.05. Anyone running NVIDIA hardware on FreeBSD should plan to update the port.

Mailing List Discussions

• Boot issues: Multiple reports of boot-time problems and hangs with 15.1 installations, particularly in diskless operation. Discussions on freebsd-stable and freebsd-current are ongoing.
• 15.1-BETA1 pkgbase fingerprint issue: Graham Perrin reported a problem with base package fingerprints in 15.1-BETA1, which Colin Percival has acknowledged.

OpenBSD 7.9 (Neighbor Note)

OpenBSD 7.9 was released on May 30 — with support for up to 255 CPU cores and WiFi 6. Not directly FreeBSD, but worth noting for anyone following the BSD ecosystem.

Week in Review

The big takeaway: AI-driven security research is no longer a theoretical concept — it’s actively finding kernel bugs in FreeBSD. At the same time, the cooperation between Calif.io/AISLE and the FreeBSD team shows what constructive engagement looks like: short reports, suggested patches, direct communication rather than CVE-count chasing.

FreeBSD 15.1-RELEASE is approaching and will include all of these fixes. If you operate multi-user systems, patch SA-26:18.setcred and SA-26:21.ptrace immediately — the rest of the advisories can wait until this week.