src/lib, branch stable/13

libnv: switch fd_wait() from select(2) to poll(2)

2026-04-28T19:36:05Z

The previous implementation used FD_SET() on a stack-allocated fd_set, which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE (1024). Approved by: so Security: FreeBSD-SA-26:16.libnv Security: CVE-2026-39457 Reported by: Joshua Rogers of AISLE Research Team (https://aisle.com/) Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56689

libarchive: Update configuration

2026-04-23T09:45:52Z

PR: 294577 MFC after: 1 week Reviewed by: mm Differential Revision: https://reviews.freebsd.org/D56468 (cherry picked from commit 05bbe5e3883492dd2afa52039da1fac45c5059a0)

libarchive: merge from vendor branch

2026-04-23T09:45:11Z

libarchive 3.8.7 Important bugfixes: #2871 libarchive: fix handling of option failures #2897 iso9660: fix undefined behavior #2898 RAR: fix LZSS window size mismatch after PPMd block #2900 CAB: fix NULL pointer dereference during skip #2911 libarchive: do not continue with truncated numbers #2919 CAB: Fix Heap OOB Write in CAB LZX decoder #2934 iso9660: fix posibble heap buffer overflow on 32-bit systems #2939 cpio: Fix -R memory leak #2947 libarchive: lzop and grzip filter support Important bugfixes between 3.8.5 and 3.8.6: #2860 bsdunzip: fix ISO week year and Gregorian year confusion #2864 7zip: ix SEGV in check_7zip_header_in_sfx via ELF offset validation #2875 7zip: fix out-of-bounds access on ELF 64-bit header #2877 RAR5 reader: fix infinite loop in rar5 decompression #2878 mtree reader: Fix file descriptor leak in mtree parser cleanup (CWE-775) #2892 RAR5 reader: fix potential memory leak #2893 RAR5: fix SIGSEGV when archive_read_support_format_rar5 is called twice #2895 CAB reader: fix memory leak on repeated calls to archive_read_support_format_cab Obtained from: libarchive Vendor commit: ded82291ab41d5e355831b96b0e1ff49e24d8939 MFC after: 1 week (cherry picked from commit eb5165bb491138f60d9004bc4c781490016d9288)

pkru: Fix handling of 1GB largepage mappings

2026-04-21T15:43:53Z

pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS set. More generally, the SET_PKRU and CLEAR_PKRU sysarch implementations did not check whether the request covers a "boundary" vm map entry. Fix this, add the missing PG_PS test, and add some tests. Approved by: so Security: FreeBSD-SA-26:11.amd64 Security: CVE-2026-6386 Reported by: Nicholas Carlini Reviewed by: kib, alc Differential Revision: https://reviews.freebsd.org/D56184

libc: Add missing MLINK for stravis(3)

2026-04-12T05:59:39Z

MFC after: 1 week Fixes: 8dfeba04eb36 ("Update to a June 8th snapshot of (un)vis form NetBSD.") Reviewed by: ziaee Differential Revision: https://reviews.freebsd.org/D56260 (cherry picked from commit a09d06bc5bff64baab76220a66c3501b89899134)

contrib/expat: import expat 2.7.5

2026-04-05T05:37:13Z

Changes: https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes Security: CVE-2026-32776 Security: CVE-2026-32777 Security: CVE-2026-32778 Security: CVE-2026-24515 Security: CVE-2026-25210 (cherry picked from commit ae04c7bbf065278687fa930e81a96767e9009d38)

rpcsec_gss: Fix a stack overflow in svc_rpc_gss_validate()

2026-03-26T01:30:00Z

svc_rpc_gss_validate() copies the input message into a stack buffer without ensuring that the buffer is large enough. Sure enough, oa_length may be up to 400 bytes, much larger than the provided space. This enables an unauthenticated user to trigger an overflow and obtain remote code execution. Add a runtime check which verifies that the copy won't overflow. Approved by: so Security: FreeBSD-SA-26:08.rpcsec_gss Security: CVE-2026-4747 Reported by: Nicholas Carlini Reviewed by: rmacklem Fixes: a9148abd9da5d (cherry picked from commit 143293c14f8de00c6d3de88cd23fc224e7014206)

libiscsiutil: Record dependency on libmd

2026-03-05T08:06:43Z

MFC after: 3 days Fixes: 6378393308bc ("Add an internal libiscsiutil library.") Sponsored by: Klara, Inc. Sponsored by: NetApp, Inc. Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D55596 (cherry picked from commit 05ca4837a3e9a413aabcf005abb14fff35088476)

system(3): Clarify return values

2026-03-04T14:46:04Z

Our manual page currently states that system() will return 127 if it fails to execute the shell. The actual return value is, to quote POSIX, “as if the command language interpreter had terminated using exit(127) or _exit(127)”. MFC after: 1 week Sponsored by: Klara, Inc. Reviewed by: bnovkov, kevans Differential Revision: https://reviews.freebsd.org/D55483 (cherry picked from commit 7305604b29d3db29c9bb5de6e7a25829fb541d1e)

libfetch: Gracefully skip unsupported protocols

2026-02-26T04:03:52Z

If socket() fails because the address family or protocol is unsupported, just continue with the next address. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D55407 (cherry picked from commit b5d570e711da1dad303312bebaf1bd2fb720f0dc)