-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-26:14.pf Security Advisory
The FreeBSD Project
Topic: pf can overflow the stack parsing crafted SCTP packets
Category: core
Module: pf
Announced: 2026-04-29
Credits: Igor Gabriel Sousa e Souza
Affects: All supported versions of FreeBSD.
Corrected: 2026-04-29 14:47:50 UTC (stable/15, 15.0-STABLE)
2026-04-29 14:48:30 UTC (releng/15.0, 15.0-RELEASE-p7)
2026-04-29 14:48:52 UTC (stable/14, 14.4-STABLE)
2026-04-29 14:49:44 UTC (releng/14.4, 14.4-RELEASE-p3)
2026-04-29 14:49:20 UTC (releng/14.3, 14.3-RELEASE-p12)
2026-04-29 14:50:08 UTC (stable/13, 13.5-STABLE)
2026-04-29 14:50:20 UTC (releng/13.5, 13.5-RELEASE-p13)
CVE Name: CVE-2026-7164
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
pf is an Internet Protocol packet filter originally written for OpenBSD.
SCTP is a transport protocol with multihome support.
pf parses SCTP packets to discover additional addresses for SCTP endpoints,
allowing it to create states allowing connections between these additional
addresses.
II. Problem Description
Incorrect packet validation allowed unbounded recursion parsing SCTP chunk
parameters. This can eventually result in a stack overflow and panic.
III. Impact
Remote attackers can craft packets which cause affected systems to panic.
This affects any system where pf is configured to process traffic,
independent of the configured ruleset.
IV. Workaround
No workaround is available. Systems not using pf are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.
Perform one of the following:
1) To update your vulnerable system installed from base system packages:
Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64
platforms, which were installed using base system packages, can be updated
via the pkg(8) utility:
# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, which were not installed using base
system packages, can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 15.0]
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-150.patch
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-150.patch.asc
# gpg --verify pf-150.patch.asc
[FreeBSD 14.4]
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-144.patch
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-144.patch.asc
# gpg --verify pf-144.patch.asc
[FreeBSD 14.3]
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-143.patch
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-143.patch.asc
# gpg --verify pf-143.patch.asc
[FreeBSD 13.5]
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-135.patch
# fetch https://security.FreeBSD.org/patches/SA-26:14/pf-135.patch.asc
# gpg --verify pf-135.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ e1c9f92130e8 stable/15-n283379
releng/15.0/ c01d9bcf0cf6 releng/15.0-n281031
stable/14/ ba21845e94dd stable/14-n274078
releng/14.4/ 0cbe512c7a80 releng/14.4-n273693
releng/14.3/ 63495b09ccf5 releng/14.3-n271490
stable/13/ ed0e766f1256 stable/13-n259861
releng/13.5/ 0ab05345fb40 releng/13.5-n259217
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat
Or visit the following URL, replacing NNNNNN with the hash:
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnySS0bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvIZAP/1GsgtB+t9rl+cOV5dv6
EeW82SX6ivf2GdmjiuXGSKoGuw3VsXPUC4RCcnFoewr1dmh+p0mGGnN0mH7lwXlT
8HG/ZF5sRXAvbaqMt2t2kPh6RbSUTfDm9TWpFQRCUmCn2PjAtrZtjQAjEZZOhfAS
domShW7gUMTHl5AA3bpSWyL/GL2/WicOkhczJAoRg8rlUiFmTg8OYWPmSZfXfLtf
E5AeXlfn5OaXFFupB+FKsdQDShU2p01kh6BtpyfH6TXa7a2yM3Cu4OdL37oy+TSi
OgH3G7/CveNXqRknOD5DJi/kwIGbWpGLGnyAerOepY3MMq8Wag5Wz0Ive2H6B6Ud
45v7cmXhDUUaNv/vAW/q+oiru0qJKzEvOlL7RWOxDLz1eL1P8Cqj9fJBLmD9Z3GW
t4QwGS09bkDcvkxyLh4HkrHwuOmZIP/OXfdHZji98N7tgmvepiNdv8e+Ww2Pm/Oc
M+E+44nx2grOpo5kewoUUT9KPxNMwn2h91Pdh2qLFCAb/HTuJ9cpPcoKvw2DAsYz
6IGLxUjQA13kkD9J7ehlvEd1/OaYxBeRIBVIJAxV2Y3OJMLhQRCu1HKz1ACNkQY0
/wHT5DXf4Q8PfGCEyEjtRI/tVAtVFdojSAfyWuxfusSjTxGD6SAz/MjWKI0oqGPZ
oTn0P+vVYzU3/bYgLl6DYOCP
=dRoD
-----END PGP SIGNATURE-----