- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 5 excluded.
Web 1
- https://wiki.freebsd.org/bhyve
Products and areas 13
- bhyvectl and the control interfaces used to manage a running VM
- bhyveload, the UEFI firmware boot path and the boot ROM interaction
- Instruction emulation for the traps that reach the hypervisor
- Nested paging and guest memory mapping, including how guest physical memory is backed on the host
- PCI passthrough and the interrupt remapping around it
- Reports go to the FreeBSD Security Team, or PGP-encrypted to the Security Officer where confidentiality matters. The project publishes the criteria it applies to decide whether an issue warrants an advisory: privilege escalation, code injection, memory disclosure and remotely triggerable denial of service. bhyve sits in the base system, so the hypervisor and its userspace are both covered
- Snapshot and suspend or resume support where it is built in
- The bhyve userspace process and its complete emulated device model
- The emulated legacy and modern devices, including AHCI, NVMe, UART, HDA and the framebuffer
- The libvmmapi library that userspace consumers link against, including third-party managers
- The virtio devices: block, net, scsi, console, rng and the 9p filesystem device
- The vmm kernel module: VM lifecycle, VMX and SVM handling, and the ioctl interface it exposes to userspace
- The VNC and framebuffer server, which listens on the network on behalf of a guest console
Out of scope (5)
- Guest operating system defects
- Jails, Capsicum and the other FreeBSD isolation mechanisms rather than bhyve
- Other parts of the FreeBSD base system unrelated to virtualization, which route through the same team but are a different target
- Third-party management wrappers such as vm-bhyve and iohyve
- TrueNAS or another downstream product's own code rather than base bhyve
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report to the FreeBSD Security Team, or PGP-encrypted to the Security Officer Team where the finding needs higher confidentiality
-
Say explicitly that the target is bhyve. The same team handles the whole base system, and a report that does not name the subsystem sits in a much larger queue
-
Split kernel from userspace in the report. A defect in the vmm module and a defect in the bhyve userspace process have very different severity
-
Give the FreeBSD release and branch. Base system components are supported across several branches at once and the fix has to be backported to each
-
Downstream products such as TrueNAS ship their own builds. If the bug is in their code rather than in base, it belongs with them
-
State whether passthrough was configured, since a guest holding a real device is a different threat model from a fully emulated one
-
Hold detail until the advisory and the patched releases are both out.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 9 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-58098 | When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, th | High 8.4 | 15 Oct 2026 |
| CVE-2026-58099 | When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these race | High 7.0 | 15 Oct 2026 |
| CVE-2026-58100 | kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged l | High 7.0 | 15 Oct 2026 |
| CVE-2026-101304 | When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. | High 7.1 | 15 Oct 2026 |
| CVE-2026-101305 | renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniqu | High 8.8 | 15 Oct 2026 |
| CVE-2026-101306 | SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. | Critical 9.8 | 15 Oct 2026 |
| CVE-2026-101307 | When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can est | High 8.2 | 15 Oct 2026 |
| CVE-2026-101308 | When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to t | Medium 5.5 | 15 Oct 2026 |
| CVE-2026-101302 | TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted r | Medium 6.5 | 15 Oct 2026 |
| CVE-2026-101303 | The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation. | High 7.5 | 15 Oct 2026 |
| CVE-2026-106931 | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. | High 8.5 | 14 Oct 2026 |
| CVE-2026-58096 | LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root. | High 8.8 | 26 Aug 2026 |
| CVE-2026-58097 | mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root. | High 7.8 | 26 Aug 2026 |
| CVE-2026-58093 | The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An unprivileged local user can exploit this race condition to escalate privileges. | High 7.0 | 26 Aug 2026 |
| CVE-2026-58094 | The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting pa | High 7.8 | 26 Aug 2026 |
| CVE-2026-58095 | mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root. | High 8.8 | 26 Aug 2026 |
| CVE-2026-58089 | When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy. | High 7.8 | 26 Aug 2026 |
| CVE-2026-58090 | The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this use-after-free to escalate privileges. | High 7.8 | 26 Aug 2026 |
| CVE-2026-58091 | The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility. On a system with a multiple audio devices, an unprivileged local user can exploit this use-after | High 7.8 | 26 Aug 2026 |
| CVE-2026-58092 | In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible. One function, group_is_primary(), was not properly updated | High 8.1 | 26 Aug 2026 |
| CVE-2026-58084 | To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace. An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSI | Medium 5.5 | 19 Aug 2026 |
| CVE-2026-58085 | After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified tran | High 7.5 | 19 Aug 2026 |
| CVE-2026-58086 | As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably tr | High 8.1 | 19 Aug 2026 |
| CVE-2026-58087 | The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating sem | High 7.8 | 19 Aug 2026 |
| CVE-2026-58088 | The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer. An unprivileged local user sharing an addres | High 7.4 | 19 Aug 2026 |
| CVE-2026-49424 | The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information. | Medium 5.5 | 19 Aug 2026 |
| CVE-2026-49425 | The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information. | Medium 5.5 | 19 Aug 2026 |
| CVE-2026-58081 | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules. | Critical 9.8 | 19 Aug 2026 |
| CVE-2026-58082 | The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflow | Critical 9.8 | 19 Aug 2026 |
| CVE-2026-58083 | While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition, the copy routine did not hold the appropriate locks while reading knote state, allowing further races. | High 8.4 | 19 Aug 2026 |
| CVE-2026-49423 | When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was allocated without zeroing. A remote TLS peer can cause the kernel to read from uninitialized iovec | Low 3.3 | 19 Aug 2026 |
| CVE-2026-49429 | The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges. | High 7.8 | 19 Aug 2026 |
| CVE-2026-49430 | The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode. | High 7.8 | 19 Aug 2026 |
| CVE-2026-49431 | The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP. | Low 3.3 | 19 Aug 2026 |
| CVE-2026-49426 | When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcome of the operation. That is, they indicate that the operation succeeded when it i | Low 3.3 | 19 Aug 2026 |
| CVE-2026-49427 | Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges. | High 8.8 | 19 Aug 2026 |
| CVE-2026-49428 | Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges. | High 8.4 | 19 Aug 2026 |
| CVE-2026-49420 | The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in | High 8.8 | 19 Aug 2026 |
| CVE-2026-49421 | The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A | High 7.1 | 19 Aug 2026 |
| CVE-2026-49422 | The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to free | High 8.4 | 19 Aug 2026 |
| CVE-2026-49415 | During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw the original credentials. An unprivileged local user can exploit this race to modify the address spac | High 8.8 | 19 Aug 2026 |
| CVE-2026-49418 | When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice. An unprivileged local user with access to a device | High 8.8 | 19 Aug 2026 |
| CVE-2026-49419 | When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while sti | High 8.8 | 19 Aug 2026 |
| CVE-2026-49416 | The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kernel, | High 7.8 | 27 Jun 2026 |
| CVE-2026-49414 | The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation | High 7.8 | 27 Jun 2026 |
| CVE-2026-49412 | The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory. An unprivileged local user can exploit this use-after-free to escalate privileges. | High 7.8 | 27 Jun 2026 |
| CVE-2026-49413 | The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-grou | High 7.1 | 27 Jun 2026 |
| CVE-2026-49417 | Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, whic | High 7.0 | 27 Jun 2026 |
| CVE-2026-45258 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel memo | High 7.8 | 27 Jun 2026 |
| CVE-2026-45259 | sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capability mode can use sigqueue(2) to send signals to any process it could signal following standard Unix permissions, bypassing the Capsicum sand | Medium 6.5 | 27 Jun 2026 |
| CVE-2026-45256 | When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The system call returned the resulting error to the caller, but by then the signal had already been delivered. The missing check allows an unprivil | Medium 5.5 | 26 Jun 2026 |
| CVE-2026-45257 | The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on | High 7.8 | 26 Jun 2026 |
| CVE-2026-45251 | A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object | High 7.8 | 21 May 2026 |
| CVE-2026-45252 | When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module calls strlen() on this daemon-supplied buffer without first verifying that the entire list is NUL | Medium 5.5 | 21 May 2026 |
| CVE-2026-45253 | ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges. The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the af | High 8.4 | 21 May 2026 |
| CVE-2026-45254 | In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process. | Medium 6.5 | 21 May 2026 |
| CVE-2026-45255 | When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshel | High 7.5 | 21 May 2026 |
| CVE-2026-39461 | libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descripto | High 8.8 | 21 May 2026 |
| CVE-2026-45250 | The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs. Because the bounds check on the supplementary grou | High 7.8 | 21 May 2026 |
| CVE-2026-42512 | As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun. A specially crafted packet can cause dhclient to overrun its buffer of environment entries. This can result in a crash, but it may be possible to levera | High 8.1 | 30 Apr 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview bhyve is the FreeBSD hypervisor, shipped in the base system and running underneath TrueNAS, firewall appliance virtualization and a substantial hosting-provider footprint. It pairs a kernel module with a full userspace device model, so the guest-to-host boundary sits in code that parses virtio rings and emulated-device registers driven straight from the guest. FreeBSD handles findings through its Security Team, publishes the criteria it uses to decide what warrants an advisory, and offers a PGP channel to the Security Officer for anything sensitive. No FreeBSD Foundation bounty exists and no FreeBSD programme appears on any commercial platform, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go to the FreeBSD Security Team, or PGP-encrypted to the Security Officer where confidentiality matters. The project publishes the criteria it applies to decide whether an issue warrants an advisory: privilege escalation, code injection, memory disclosure and remotely triggerable denial of service. bhyve sits in the base system, so the hypervisor and its userspace are both covered The vmm kernel module: VM lifecycle, VMX and SVM handling, and the ioctl interface it exposes to userspace Nested paging and guest memory mapping, including how guest physical memory is backed on the host Instruction emulation for the traps that reach the hypervisor The bhyve userspace process and its complete emulated device model The virtio devices: block, net, scsi, console, rng and the 9p filesystem device The emulated legacy and modern devices, including AHCI, NVMe, UART, HDA and the framebuffer PCI passthrough and the interrupt remapping around it bhyveload, the UEFI firmware boot path and the boot ROM interaction The VNC and framebuffer server, which listens on the network on behalf of a guest console bhyvectl and the control interfaces used to manage a running VM The libvmmapi library that userspace consumers link against, including third-party managers Snapshot and suspend or resume support where it is built in Out of scope Other parts of the FreeBSD base system unrelated to virtualization, which route through the same team but are a different target Jails, Capsicum and the other FreeBSD isolation mechanisms rather than bhyve Third-party management wrappers such as vm-bhyve and iohyve TrueNAS or another downstream product's own code rather than base bhyve Guest operating system defects Most-valued findings Guest-to-host escape out of the userspace device model, the primary boundary this hypervisor defends and the one worth the most on a shared hosting fleet Memory safety in virtio device handling, where descriptor rings, indices and lengths arrive directly from the guest Emulated device parsing for AHCI, NVMe and the legacy device set, historically the densest escape surface in any type-2 hypervisor Anything reachable through the vmm ioctl interface that lets an unprivileged host user affect a running VM or the kernel itself Host memory disclosure into a guest, one of the four classes FreeBSD names explicitly as advisory-worthy Defects in the VNC or framebuffer path, which take input from the network rather than from the guest and are often exposed further than intended PCI passthrough and interrupt handling, where a guest holding a real device can reach host memory it was never assigned Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to the FreeBSD Security Team, or PGP-encrypted to the Security Officer Team where the finding needs higher confidentiality Read the published advisory-warrant criteria first. FreeBSD names privilege escalation, code injection, memory disclosure and remotely triggerable denial of service as the classes that earn an advisory Say explicitly that the target is bhyve. The same team handles the whole base system, and a report that does not name the subsystem sits in a much larger queue Split kernel from userspace in the report. A defect in the vmm module and a defect in the bhyve userspace process have very different severity Give the FreeBSD release and branch. Base system components are supported across several branches at once and the fix has to be backported to each Downstream products such as TrueNAS ship their own builds. If the bug is in their code rather than in base, it belongs with them State whether passthrough was configured, since a guest holding a real device is a different threat model from a fully emulated one Disclosure Coordinated by the FreeBSD Security Team, or by the Security Officer over PGP where confidentiality demands it, and published as a FreeBSD Security Advisory with patches for every supported branch at once. The project publishes the decision tree it uses to judge whether an issue warrants an advisory, so expect an explicit determination rather than silence. Hold detail until the advisory and the patched releases are both out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability