OpenBSD 7.9 Errata

Patches for the OpenBSD base system are distributed as unified diffs. Each patch is cryptographically signed with the signify(1) tool and contains usage instructions. All the following patches are also available in one tar.gz file for convenience.

Alternatively, the syspatch(8) utility can be used to apply binary updates. Full binary updates are made available on the following architectures: amd64, i386, arm64. On other architectures, only machine-independent updates are produced (and these are exceedingly rare).

Patches for supported releases are also incorporated into the -stable branch, which is maintained for one year after release.

• 001: SECURITY FIX: June 2, 2026   All architectures
  Multiple vulnerabilites in the X server dri2, sync, saver and Xkb extensions.
  A source code patch exists which remedies this problem.

• 002: RELIABILITY FIX: June 2, 2026   All architectures
  Fixes for a variety of crashing bugs in smtpd(8).
  A source code patch exists which remedies this problem.

• 003: RELIABILITY FIX: June 2, 2026   amd64 arm64
  In vmd(8), fix a variety of crashing bugs and misbehavior of -b flag.
  A source code patch exists which remedies this problem.

• 004: RELIABILITY FIX: July 16, 2026   All architectures
  Fix some info leaks, kernel crashes, and pinsyscall(8) / kbind(8) locking failures.
  A source code patch exists which remedies this problem.

• 005: SECURITY FIX: July 16, 2026   All architectures
  Fix numerous problems in the System V (sem, msg, ipc) system call layers.
  A source code patch exists which remedies this problem.

• 006: RELIABILITY FIX: July 16, 2026   All architectures
  Fix double-free, memory leaks, and vnode references in NFS server.
  A source code patch exists which remedies this problem.

• 007: RELIABILITY FIX: July 16, 2026   All architectures
  Stricter IPsec and IPComp input validation prevents kernel crash.
  A source code patch exists which remedies this problem.

• 008: RELIABILITY FIX: August 11, 2026   All architectures
  Heap or stack corruption in npppd(8) LCP option handling could lead to crashes.
  A source code patch exists which remedies this problem.

• 009: RELIABILITY FIX: August 11, 2026   All architectures
  iked(8) could be crashed remotely pre authentication.
  A source code patch exists which remedies this problem.

• 010: SECURITY FIX: August 22, 2026   All architectures
  Interface ioctl(4) could leak 4 bytes of kernel memory.
  A source code patch exists which remedies this problem.

• 011: RELIABILITY FIX: August 22, 2026   All architectures
  A race in pledge(2) namei check could trigger a kernel panic.
  A source code patch exists which remedies this problem.

• 012: SECURITY FIX: August 22, 2026   All architectures
  The sysctl(2) kern.proc could leak kernel memory.
  A source code patch exists which remedies this problem.

• 013: RELIABILITY FIX: August 22, 2026   All architectures
  TIOCGSID on tty(4) could trigger a kernel panic.
  A source code patch exists which remedies this problem.

• 014: SECURITY FIX: August 22, 2026   All architectures
  Backport all changes from libexpat 2.8.3. CVE-2026-45186 CVE-2026-50219 CVE-2026-56131 CVE-2026-56132 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407 CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412 CVE-2026-72522
  A source code patch exists which remedies this problem.

• 015: SECURITY FIX: September 14, 2026   All architectures
  In smtpd(8) a custom MDA could execute arbitrary code as an unprivileged recipient user.
  A source code patch exists which remedies this problem.

• 016: SECURITY FIX: September 14, 2026   All architectures
  A malicous NFS server could aid a local user in avoiding access controls.
  A source code patch exists which remedies this problem.

• 017: RELIABILITY FIX: September 14, 2026   All architectures
  Prevent integer overflow in wscons(4).
  A source code patch exists which remedies this problem.

• 018: RELIABILITY FIX: September 14, 2026   All architectures
  Prevent integer overflow in shmat(4).
  A source code patch exists which remedies this problem.

• 019: SECURITY FIX: September 14, 2026   All architectures
  Backport all changes from libexpat 2.8.4. CVE-2026-66046 CVE-2026-76641 CVE-2026-76957
  A source code patch exists which remedies this problem.

• 020: SECURITY FIX: September 14, 2026   All architectures
  Multiple vulnerabilities in the X server and server side font library. CVE-2026-55999 CVE-2026-56000 CVE-2026-56001 CVE-2026-56002 CVE-2026-56003
  A source code patch exists which remedies this problem.

• 021: SECURITY FIX: September 14, 2026   All architectures
  In ldapd(8), an authentication result from one transaction could be applied to another.
  A source code patch exists which remedies this problem.

• 022: SECURITY FIX: September 30, 2026   All architectures
  Update nsd(8) to version 4.15.2. CVE-2026-12244 CVE-2026-12245 CVE-2026-12246 CVE-2026-12490 CVE-2026-18664 CVE-2026-18916 CVE-2026-19401 CVE-2026-19538
  A source code patch exists which remedies this problem.

• 023: SECURITY FIX: September 30, 2026   All architectures
  Update unbound(8) to version 1.26.1. CVE-2026-14586 CVE-2026-32665 CVE-2026-32792 CVE-2026-33278 CVE-2026-40622 CVE-2026-40691 CVE-2026-41292 CVE-2026-41637 CVE-2026-42534 CVE-2026-42923 CVE-2026-42944 CVE-2026-42955 CVE-2026-42959 CVE-2026-42960 CVE-2026-44390 CVE-2026-44608 CVE-2026-44621 CVE-2026-44687 CVE-2026-44690 CVE-2026-46582 CVE-2026-50045 CVE-2026-50046 CVE-2026-50243 CVE-2026-50248 CVE-2026-50251 CVE-2026-50252 CVE-2026-52863 CVE-2026-54478 CVE-2026-55708 CVE-2026-55717 CVE-2026-55973 CVE-2026-55990 CVE-2026-55991 CVE-2026-56416 CVE-2026-56444
  A source code patch exists which remedies this problem.

• 024: SECURITY FIX: September 30, 2026   All architectures
  Fix a variety of bugs in libressl:
  • Remove RelativeDistinguishedName support for CRL distribution points
  • Ensure verify callbacks always returning 1 can see a hostname mismatch
  • Correct botched size check in dtls1_preprocess_fragment()
  • Limit size of buffered DTLS handshake messages
  • Avoid potential overread on interrupted retransmission in DTLS
  • Fix OCSP responder authorization bypass in libtls and ocspcheck(8)
  
  A source code patch exists which remedies this problem.

• 025: SECURITY FIX: September 30, 2026   All architectures
  An errant process could cause ps(1) to crash due to a buffer overflow in sysctl(2).
  A source code patch exists which remedies this problem.

• 026: SECURITY FIX: September 30, 2026   All architectures
  A reference counting bug could lead to use-after-free in the kernel.
  A source code patch exists which remedies this problem.

• 027: SECURITY FIX: September 30, 2026   All architectures
  A malicious IKEv2 peer could crash iked(8), or cause a certificate validation verdict to be applied to the wrong peer identity.
  A source code patch exists which remedies this problem.

• 028: SECURITY FIX: September 30, 2026   All architectures
  After wg(4) interface destruction a use-after-free could be triggered by incoming packets.
  A source code patch exists which remedies this problem.

• 029: SECURITY FIX: September 30, 2026   All architectures
  Semaphore operation semop(2) could trigger a use-after-free in the kernel.
  A source code patch exists which remedies this problem.

• 030: SECURITY FIX: September 30, 2026   All architectures
  Incorrect upper bound for uid and gid can result in -1 being used.
  A source code patch exists which remedies this problem.