FreeBSD vt(4) CONS_HISTORY ioctl integer overflow leading to local privilege escalation (CVE-2026-49416)

Vulnerability Overview Vulnerability Name: Integer overflow in vt(4) CONS_HISTORY ioctl Vulnerability ID: CVE-2026-49416 Publication Date: 2026-06-09 Affected Versions: All supported versions of FreeBSD Module: vt Advisory Date: 2026-06-09 Fix Date: 2026-06-09 Impact Scope Impact Description: Unauthorized local users can trigger out-of-bounds writes to the kernel by accessing the vt(4) device, potentially leading to privilege escalation. Specific Impact: The CONS_HISTORY ioctl handler fails to correctly calculate the requested history size, resulting in an integer overflow in the buffer size calculation. This leads to a heap allocation that is smaller than expected. Subsequent buffer initialization writes beyond the allocated region. Remediation Plan 1. Upgrade System: - For FreeBSD systems installed from base system packages, use the pkg(8) utility to update to the 15.0-RELEASE version. - For FreeBSD systems installed from binary distribution sets, use the freebsd-update(8) utility to update. - For FreeBSD systems installed from source code, download and apply the corresponding patches. 2. Specific Steps: - Update Base System Packages: - Update Binary Distribution Sets: - Update from Source Code: - Download patches and verify signatures: - Apply patches: - Recompile the kernel and restart the system. References CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-49416 Latest Revision: https://security.FreeBSD.org/advisories/FreeBSD-SA-26:34.vt.asc Patch Information Patch Hashes: - stable/15: deada0f1d3c4 - releng/15.1: 8cd11f31d4d4 - releng/15.0: f4cf9770f6f2 - stable/14: b3a4ef0b795 - releng/14.4: 7996d3013405 - releng/14.3: 9cbda2c28616 Verify Patches View the files modified by a specific commit using the following command: Or access the following URL to view the commit: Determine the number of commits in the working tree: Signature Signature Content: The above is a summary of the key vulnerability information.

Goal Reached Thanks to every supporter — we hit 100%!

FreeBSD vt(4) CONS_HISTORY ioctl integer overflow leading to local privilege escalation (CVE-2026-49416)