-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

============================================================================= FreeBSD-EN-26:17.rpcsec_tls Errata Notice
The FreeBSD Project

Topic: Socket refcount underflow in the NFS server

Category: core
Module: rpcsec_tls
Announced: 2026-06-30
Affects: FreeBSD 15.0 and later
Corrected: 2026-06-22 13:26:26 UTC (stable/15, 15.1-STABLE)
2026-06-30 17:21:51 UTC (releng/15.1, 15.1-RELEASE-p1)
2026-06-30 17:21:19 UTC (releng/15.0, 15.0-RELEASE-p11)

For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

I. Background

The kernel RPC subsystem implements Transport Layer Security (TLS) for
NFS. TLS handshakes are performed by the userspace daemon
rpc.tlsservd(8) via an upcall mechanism: the kernel inserts a pending
socket into a lookup tree, invokes the daemon, and removes the socket
once the handshake completes or fails.

II. Problem Description

When the kernel inserted a socket into the upcall tree, it did not
acquire its own reference on the socket. If the TLS handshake upcall subsequently failed, the error-handling path closed the socket to
clean up the tree entry, but this effectively released the transport
layer's reference rather than one owned by the upcall tree.

III. Impact

A server-side TLS handshake failure, for example because rpc.tlsservd(8)
is not running, can cause a socket reference count underflow in the NFS
server. This results in a kernel panic.

IV. Workaround

No workaround is available. Systems that are not running an
NFS server are not affected.

V. Solution

Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date, and reboot the
system.

Perform one of the following:

1) To update your system installed from base system packages:

Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility:

# pkg upgrade -r FreeBSD-base
# shutdown -r now

2) To update your system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r now

3) To update your system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/EN-26:17/rpcsec_tls.patch
# fetch https://security.FreeBSD.org/patches/EN-26:17/rpcsec_tls.patch.asc
# gpg --verify rpcsec_tls.patch.asc

b) Apply the patch. Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI. Correction details

This issue is corrected as of the corresponding Git commit hash in the following stable and release branches:

Branch/path Hash Revision
- ------------------------------------------------------------------------- stable/15/ f3b14134dec1 stable/15-n284051 releng/15.1/ c04ca8bd36f7 releng/15.1-n283564 releng/15.0/ 7b3373d4eb5f releng/15.0-n281066
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289734>

The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:17.rpcsec_tls.asc> -----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmpEEi4bFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv6iMP+wfOwos1/WMyrtvqWs7a u3kbN4H3ricGyNAP4SE1dEWAiFOkG17CaSBgvJMFHm4dOqtoCzSuHrwx6zOzCwbr xSQE4LKcfimt/hh59cF1Q0701Hwk7kkf8h/hTIgF0gGr3OW+OtdguNj+p3Qx6zMG 0wZxTM5+dTquAwlmi3YUwR5+WOu9/rUoqk88m6HlddqoyGWdbhIR6X2YLD4c1zV9 ErPckBTcBt2anBZYYwzPhmbnRE4IFfESFPvpkqPaxzga4mbQ2RZRUit2eCFwb+WD rDhImlpcPLvJm9slvEfJw4y4pjQjIRWuKT0VBv9oobU86+3l2NPnMwU24lL6X0y3 XEljVwjQ7ODgyGySS9FDoLzGSwnjQ+LnpNWy6yn+GV9a4v7Dp8PBduF+bLSdusrl 8zWU9EGYOv9svF8Z8Wd7uQWsAvHgXoyb2GxRhV7jj4M/BG4+49OSvW0p1u0ZwyXt 2CUiZV59MBaVddzk3Lu5iHmvVkbyNYvChGulea1j3QBn9FyrHWZ6EZ6lSXT9k5gv RF4sT/tnx2xf/mBz2wz2yfBviprkfQwoGhBJ7txiPFsrvLIwcW+pegrRYcJ9Bx21 GagSCWTKp7MBP1TX6L8JWiVj283m0PV48fH3Cztoa5cj5zr97USNWiCJhdDxQH52 3RRPzqVEk2s3HPdMGoz5zwus
=LLkf
-----END PGP SIGNATURE-----


--- PyGate Linux v1.5.18
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)