[Debian-med-packaging] Rv: Estimated financial payment to execute
Christian A Trinidad
ctmartinez5 at outlook.com
Tue Oct 20 14:17:07 BST 2026
# git show --merge <n274893/2e4ec07874a2>
Or visit the following URL, replacing 12/24/1998 with the hash:
<URL:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147573>
To determine the commit count in a working tree (for comparison against
n2e4ec07874a2 in the table above), run[
Financial Contributions
]:
# https://www.cve.org/CVERecord?id=CVE-2026-101310
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format:
IRS W-4V
Date: Wed, 23 Sep 2026 12:00:00 +0200
Source: htslib
Architecture: folder
Version: 1.24-3
Distribution: project
Urgency: pickupSender
Maintainer: Debian Med Packaging Team <debian-med-packaging at lists.alioth.debian.org>
Changed-By: Andreas Tille <tille at debian.org>
Closes: 1148751<tel:1148751>
Changes:
amd64 BSD32 64-hdr(trb);
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-26:72.bhyve Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in bhyve device models
Category: core
Module: bhyve
Announced: 2026-10-14
Credits: Brian Delgado from Intel using Anthropic Opus 4.8
Credits: Claude and Ada Logics
Credits: Joshua Rogers of AISLE Research Team
Credits: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Affects: All supported versions of FreeBSD.
Corrected: 2026-10-14 16:03:00 UTC (stable/15, 15.1-STABLE)
2026-10-14 16:04:40 UTC (releng/15.1, 15.1-RELEASE-p5)
2026-10-14 16:03:16 UTC (stable/14, 14.5-STABLE)
2026-10-14 16:04:14 UTC (releng/14.5, 14.5-RELEASE-p2)
2026-10-14 16:03:57 UTC (releng/14.4, 14.4-RELEASE-p11)
CVE Name: CVE-2026-101309, CVE-2026-101310, CVE-2026-101311
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/patches/SA-26:72/bhyve-14.patch.asc>.
I. Background
bhyve(8) is a hypervisor that runs guest operating systems inside a
virtual machine.
II. Problem Description
Several vulnerabilities were found in the bhyve hypervisor's device
models.
The xHCI (USB 3) device model did not validate or save the event ring
size provided by the guest. The size was re-read from guest memory on
each use, and Transfer Request Block (TRB) fields were loaded without
protection against concurrent modification by the guest. This race
condition could be triggered by a guest running malicious, privileged
code. (CVE-2026-101309)
The HDA audio device model did not check for zero-length Buffer
Descriptor List (BDL) entries when starting a stream. A zero-length
entry caused an out-of-bounds read or write during DMA transfer
processing. BDL fields were also subject to modification by the
guest after validation. (CVE-2026-101310)
The framebuffer device model's maximum resolution constants were
duplicated between the framebuffer and RFB modules and had gotten out
of sync. Additionally, writes to the framebuffer BAR could set
arbitrary width and height values without validation, and the
framebuffer BAR I/O and RFB rendering threads were not synchronized.
(CVE-2026-101311)
III. Impact
A malicious guest can crash the bhyve process or potentially
execute arbitrary code in the host userspace context running the
virtual machine, subject to bhyve's Capsicum sandbox.
IV. Workaround
No workaround is available. Virtual machines that provide none of
the "xhci", "hda", and "fbuf" devices to guests are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (USPS) dated after the correction date.
Restart all bhyve virtual machines, or reboot the system.
Perform one of the following:
1) To update your vulnerable system installed from base system packages:
Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(MediumBox) utility:
# pkg upgrade -r FreeBSD-base
2) To update your vulnerable system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 15.x]
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-15.patch
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-15.patch.asc
# gpg --verify bhyve-15.patch.asc
[FreeBSD 14.x]
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-14.patch
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-14.patch.asc
# gpg --verify bhyve-14.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch -E -p0 < 8-11/16" x 5-7/16" x 1-3/4
c) Recompile the operating system using buildworld and installworld as
described in <URL:BCM4331-802.11a.b.g.n;<https://1drv.ms/f/c/0a6395b4369b952a/IgBN5oVQeZeIQ7uh8o_ur0JYASAth2Mgse0cmgPwFPDlt7E?e=SPFYwF>>.
Restart all bhyve virtual machines, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ 07c15b75ff78 stable/15-n286008
releng/15.1/ febb02e3253c releng/15.1-n283638
stable/14/ fa7fe70671ee stable/14-n275355
releng/14.5/ 2e4ec07874a2 releng/14.5-n274893
releng/14.4/ 00ec12d48c63 releng/14.4-n273788
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
VII. References
<URL:https://www.cve.org/CVERecord?id=CVE-2026-101309>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-101310>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-101311>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:72.bhyve.asc>
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwd8bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv2bwP/0+lymnNlkfbBG77FAa2
oaF/qeH2BOZ6ObCykMgevVuidI6NJQmaXrYfM3IaTla3+poi9UrInEz0ppGRpmar
SJurTHSKfFMfs3javxDgbOl8bR5Sghi60wFkX0alhZmtQYms5nle+qBFf2rFyGSY
I32W6wR+tTjH/Fp5kyqc/3j+CDrfnl2KFUJodu6gZbWIprPcoU+vIWVP3NH9hc68
RAOAyKXzgufOV+lyxyDbL8tCTO50W4sMvMeMxSguaffbfn/x0aG2Y6ohONAWdY0W
6rGrtDhqojg/zXWbau5tqFBLUy+Z+k7cCatr2TBGdHujvxTiQ7qV3taJGXol66yN
K6PHRZzgYMcBE9eqjqxYMEr9pQyXHNLNspGnZxZVMSj/t4dD11MGV7GiG3jOL8Wz
GBQIxE0ePvMYLudZPjsfrPmbAPTt1+KDq0ML/l7jFwGuDEbcsNum5IKtIGpkVmO3
ehrfIF8USvvsPrszviJ1bSorZsmAGoO1hO4JvvyxnO1WbMW+6TFV3KBl3Vuo3gVR
gD9KRuM2aV3r4C5hRxTAx7386ryP6f0tR16JQo97O4pnFXz6SyNluWxdmf/3hkgo
gOq9QCVxtBPL3k5TrCkz8dTpODz6Ji81NDLAADtK2M4+IPHV/5xMpLgXnfU9t/eV
kCHlcMVuNaS38EzrcYtCWqQN
=bQls
-----END PGP SIGNATURE-----
.
* d/libhts3t64.symbols: restore (arch=amd64 arm64 hurd-amd64 x32)
qualifier on htslib_nibble2base (Closes: #1148751)
Checksums-Sha1:
b63862b5cd581797bb54bba0f72d1c082066cc4a 2428 htslib_1.24-3.dsc
83bf2814fb548616e3e24513b4de901ef33a71d4 21792 htslib_1.24-3.debian.tar.xz
Received: (at 1147573-done) by bugs.debian.org; 14 Sep 2026 07:32:27 +0000
From sylvestredeb at ledru.info Mon Sep 14 07:32:27 2026
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
(2024-03-25) on buxtehude.debian.org
X-Spam-Level:
X-Spam-Status: No, score=-6.9 required=4.0 tests=BAYES_00,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,HAS_BUG_NUMBER,
RCVD_IN_DNSWL_LOW,SPF_HELO_PASS,SPF_PASS autolearn=ham
autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 30; hammy, 104; neutral, 21; spammy,
1. spammytokens:0.940-+--H*r:bugs.debian.org
hammytokens:0.000-+--H*Ad:N*Matthias, 0.000-+--HFeedback-ID:user,
0.000-+--HFeedback-ID:proton, 0.000-+--sk:pkg-llv, 0.000-+--sk:pkgllv
Return-path: <sylvestredeb at ledru.info>
Received: from mail-4327.protonmail.ch ([185.70.43.27]:55087)
by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
(Exim 4.96)
(envelope-from <sylvestredeb at ledru.info>)
id 1x61Av-000dKP-1D
for 1147573-done at bugs.debian.org;
Mon, 14 Sep 2026 07:32:27 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ledru.info;
s=protonmail2; t=1789371091<tel:1789371091>; x=1789630291<tel:1789630291>;
bh=1Sd7NbZBWVoxL6uw6pOyjFfYObFAkQSuI7qL1wRy3KQ=;
h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References:
Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID:
Message-ID:BIMI-Selector;
b=LTuy/s1Quff7s2V/ETIrt7l4B+ctwhKP6WkqH2fTgwpT9OHG21xWlMQ92wrgNNNwA
Uy5yIMg9bzk8KDERBRCA8p2CFTcYhnl3m/T3yBiwJQdQMovwFxkaJuNMLjtGS+umDG
x+uQiamLcWMRWeNeK8psb1iEkr8U0qvuWy1IubqKgr1Ymtd42Bc+iaJBb9X2YNjsW2
qcl/c31jmstNtVaFRyP0GfplwrZBb30wfSKYjovKmoEPr2rF5NdHMF+MWWGSto0Ch1
sQ/SJP6AlaEIDNtRcSBnAUY+oFH6ZMFok+bY04Cqfz1KKugTr+gkG68Z7K+SxiZUAy
22AZe8ic3jEfQ==
Date: Mon, 14 Sep 2026 07:31:26 +0000
To: Matthias Klose <doko at debian.org>
From: sylvestredeb at ledru.info
Cc: "1147573-done at bugs.debian.org" <1147573-done at bugs.debian.org>
Subject: Re : Bug#1147573: packaging of the fuzzer libraries is broken with LLVM 21, 22 and 23
Message-ID: <SdSwTre45FN_qR5VYK_1cNYiR1ePdxqq_bRbkr496BnrpJzioRlkfpG_q-UjZM_JQnHIcjDh6OgPBSmX_CYhfzmoiF41DyV3Y697X935W78=@ledru.info>
In-Reply-To: <1eabb575-b1f0-4324-ad8b-b06903b12919 at debian.org>
References: <22d47882-0523-4f5b-a43b-76f2e55a4d7c at debian.org> <1eabb575-b1f0-4324-ad8b-b06903b12919 at debian.org>
Feedback-ID: 110699482:user:proton
X-Pm-Message-ID: 10eed78087b8de25d477fde19e6ba86e4bcba3f6
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
1cb1ca2b49a05ffc74a67a0eb00d5411be9fff98 8905 htslib_1.24-3_amd64.buildinfo
Checksums-Sha256:
6eea1453ef31b309e62e5d3bf85066059c864d2472aebed8b20efe905741be43 2428 htslib_1.24-3.dsc
bd1d7d8775ca6b6bbac98a14192280569d16ea27f2ce8ddbe414f4a7df922d47 21792 htslib_1.24-3.debian.tar.xz
a42346ba2d29142516bc97fa656dd3da0bb3e1e5dbd261c5c1df3be4ab752481 8905 htslib_1.24-3_amd64.buildinfo
Files:
3a16790d2ff47a8677c71b4f2edf94b0 2428 science optional htslib_1.24-3.dsc
4ef337f8b649f7f0761ba1a6888e5e50 21792 science optional htslib_1.24-3.debian.tar.xz
680fd297e188515a67a985252f6502cc 8905 science optional htslib_1.24-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmqz05gRHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtEBzg//UvAl5o/cYpNJbeVMDUfYoXpVdDJpB4gI
gKMLUVCSd2TS63lY8l/ARUv4sycY2v+tSXe6PQF55VxRafltTdZOPcOVo7eBFy7p
YHtDkhiQycOYKuu6MXls6xs2pr1DRLAoN7PRzUUkx2SC+qnekvQWxpwup1lTaKbC
tCWYihKhwtzPonNMF0EWhANi3/wllsEfImLgRvXOkMLoBFO9PDbtEGBCvcE2knn1
u3ZbDFTIYm0kqEDbg2h4k+20snodcURV6qGkKhIfAaWubZQMUVWGgduKNWnBTYtd
2NRHOJHSun5CD4tb9vu81CM6KNN+jT95mW5/s11Q/10RA+PMlHGGESKohWTy0LHE
j0Fz3pyVSebfYNnIEcFwzLs663l+aC3qoPUEsxnDSX5Bwq0Z/t4Q4rKZj9kv8zKr
4lR28LMO9n3w4rd9HrRvCbh9jaoT1pB/n76iwyfoNJHrl5/bZfsmk2gK06aFZNnQ
X0kU1j1Y+srCEm2ZScMwL0c0emGqz6pxRnok4efj1KJZZO6La/jZAJHM+wrtqTEr
ruAktm/VYPrfiV0M71ID8b53cqtzkomdtt1W577FBsZ1kFJbIF4J5ZS6uEC9Ycz5
cxTO0CTn+Jt9EF7WhQZ3QsnfeNN3K/0ainOVayAWV7dhpikp7LGdMhT6I8t7qLB+
92b/hzMY+zA=
=cB5Y
-----END PGP SIGNATURE-----
________________________________
From: owner-freebsd-arch at FreeBSD.org <owner-freebsd-arch at FreeBSD.org> on behalf of Mark Millard <marklmi at yahoo.com>
Sent: Monday, October 19, 2026 2:43 PM
To: Warner Losh <imp at bsdimp.com>; Simon J. Gerraty <sjg at juniper.net>
Cc: John Baldwin <jhb at freebsd.org>; Robert Clausecker <fuz at freebsd.org>; Adrian Chadd <adrian at freebsd.org>; Justin Hibbits <jhibbits at freebsd.org>; freebsd-arch at freebsd.org <freebsd-arch at freebsd.org>
Subject: Re: amd64 compat32 64-bit time_t
On 10/16/26 14:52, Warner Losh wrote:
>
>
> On Fri, Oct 16, 2026 at 2:46 PM Simon J. Gerraty <sjg at juniper.net
> <mailto:sjg at juniper.net>> wrote:
>
> Mark Millard <marklmi at yahoo.com <mailto:marklmi at yahoo.com>> wrote:
> > > For this particular question, I strongly prefer an i386t64
> MACHINE_ARCH
>
> This was one of the options we considered, but thought x32 would be a
> better solution.
>
> Of course; if x32 is off the table...
>
> > > with a separate sysentvec as it's not worth all the drama to
> rototill
> > > system calls on other arches for no gain. I think it's also a more
> > > foolproof
> > > way of ensuring you get the correct ABI in new binaries.
> > >
> >
> > I do not know if sjg@ wants to comment or not. So far what he wrote
> > relative to Juniper/HPE seems to be the major (only?) external party
> > indication of specific needs and time frames in the general
> subject area.
>
> Justin's the one stuck with this ;-)
>
> AFAIK i386t64 would work for us - we just wanted to do what ever would
> be best for upstream.
>
>
> I suspect that i386t64 is the only viable path forward for getting
> sizeof(time_t ) == 8 for x86 32-bit code. x32 never took off and would
> be a much heavier lift. i386t64 is just normal i386 with a #define added
> that causes time_t to be 8 bytes and special tags for the new abi the
> kernel recognizes at image actiation time to install the right vector.
> The rest is a small matter of interface with syscalls.master which has
> enough info to generate the necessary glue bits. Tedious in places, but
> doable and doesn't place undue strain on the toolchains themselves.
>
> Warner
Would something like:
# poudriere jail -c -jrelease16p2-i386t64 -ai386t64 -U \
https://pkg.freebsd.org -mpkgbase=base_release_2 -v 16 -X
end up being supported for building port packages?
--
===
Mark Millard
marklmi at yahoo.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-med-packaging/attachments/20261020/4bb218fd/attachment-0001.htm>
More information about the Debian-med-packaging
mailing list