When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled.

Under certain conditions involving use of the highlight buffer while text is scrolling on the console, console data may overwrite data structures associated with the system console or other kernel memory.

Operations specific to TLB invalidation in PCID mode were misordered with respect to IPI transmission.

The hard-coded size for state region 1 (SSE/XMM) was incorrect, effectively filling the xmm8 through xmm15 registers with arbitrary values on signal return when the init optimization occurred.

A programming error in the Linux compatibility layer futex(2) system call might allow attackers to cause a denial of service

Insufficient locking in the kernel meant that destroying an epair and a vnet jail at the same time often resulted in panics.

All execve/fexecve system calls in affected versions will be reported as a failure, even upon successful execution.

The Stream Control Transmission Protocol (SCTP) is a message oriented transport protocol supporting arbitrary large user messages. It can be accessed from applications by using the the socket API.

IPv6 is a network layer supporting Hop-by-Hop options, which can be sent by applications via the socket API. The memory management for packet handling is done using mbufs.

The Linux ABI layer (Linuxulator) allows Linux binaries to be executed on a FreeBSD kernel.

When handling a 32-bit sendmsg(2) call, the compat32 subsystem copies the control message to be transmitted (if any) into kernel memory, and adjusts alignment of control message headers.

A missing length validation code common to these three drivers means that a malicious USB device could write beyond the end of an allocated network packet buffer.

USB Human Interface Device (HID) descriptors may push/pop the current state to allow description of items residing in a so-called union.

A missing NUL-termination check for the jail_set(2) configration option “osrelease” may return more bytes when reading the jail configuration back with jail_get(2) than were originally set.

Incorrect use of a potentially user-controlled pointer in the kernel allowed vnet jailed users to panic the system and potentially execute aribitrary code in the kernel.