FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Arm CPU errata may bypass page table permission changes

Affected packages
15.0 <= FreeBSD-kernel < 15.0_10
14.4 <= FreeBSD-kernel < 14.4_6
14.3 <= FreeBSD-kernel < 14.3_15

Details

VuXML ID 438b0278-6474-11f1-958d-bc241121aa0a
Discovery 2026-06-09
Entry 2026-06-10

Problem Description:

Some Arm CPUs have errata where the ordering of stores and the TLBI+DSB sequence may be incorrect. If one CPU stores to a virtual address while another CPU invalidates the translation for that address, the second CPU's TLBI+DSB may complete before the first CPU's store has been globally observed.

Impact:

This erratum may allow software to write to a previously writable location after the page table is modified to forbid writes to that location. Consequently this may allow software to write to memory owned by a higher exception level, possibly allowing software to escalate privilege to that higher exception level.

References

CVE Name CVE-2025-10263
FreeBSD Advisory SA-26:31.arm64