OpenBSD 8.0 Errata

Patches for the OpenBSD base system are distributed as unified diffs. Each patch is cryptographically signed with the signify(1) tool and contains usage instructions. All the following patches are also available in one tar.gz file for convenience.

Alternatively, the syspatch(8) utility can be used to apply binary updates. Full binary updates are made available on the following architectures: amd64, i386, arm64. On other architectures, only machine-independent updates are produced (and these are exceedingly rare).

Patches for supported releases are also incorporated into the -stable branch, which is maintained for one year after release.

• 001: RELIABILITY FIX: October 20, 2026   All architectures
  In ppp(4), an off-by-one error could lead to an out-of-bounds write.
  A source code patch exists which remedies this problem.

• 002: SECURITY FIX: October 20, 2026   All architectures
  Backport security fixes from nsd(8) version 4.15.3. CVE-2026-101337 CVE-2026-101338 CVE-2026-101339 CVE-2026-101341
  A source code patch exists which remedies this problem.

• 003: SECURITY FIX: October 20, 2026   amd64 octeon
  When IPsec is used with AES-GMAC, a kernel heap overflow could be triggered remotely. Only amd64 with AES-NI and octeon with crypto coprocessor are affected. AES-GCM is not affected.
  A source code patch exists which remedies this problem.

• 004: SECURITY FIX: October 20, 2026   All architectures
  Multiple bugs in video(4) could lead to use-after-free and kernel memory corruption.
  A source code patch exists which remedies this problem.

• 005: SECURITY FIX: October 23, 2026   All architectures
  Add the dbupdate utility that can be used to update /etc/ssl/cert.pem and /usr/share/zoneinfo.
  This erratum includes an updated /etc/ssl/cert.pem. If you require local overrides, place them in /etc/ssl/cert.local.pem. Running dbupdate(8) will prepend these overrides to the updated cert.pem.
  A source code patch exists which remedies this problem.

• 006: RELIABILITY FIX: November 5, 2026   All architectures
  By sending crafted IKEv1 messages, an unauthenticated remote attacker could crash isakmpd(8) due to a NULL pointer dereference, out-of-bounds memory accesses or a double free.
  A source code patch exists which remedies this problem.

• 007: SECURITY FIX: November 5, 2026   All architectures
  Multiple security issues in X.Org X client libraries. CVE-2026-88806 CVE-2026-88807 CVE-2026-93541 CVE-2026-93542 CVE-2026-93543 CVE-2026-93544 CVE-2026-93545 CVE-2026-94281 CVE-2026-94282 CVE-2026-94283 CVE-2026-94284 CVE-2026-94285 CVE-2026-94286 CVE-2026-94287 CVE-2026-109088 CVE-2026-109089 CVE-2026-109090
  A source code patch exists which remedies this problem.

• 008: RELIABILITY FIX: November 5, 2026   All architectures
  If pf is configured with FQ-CoDel queueing, sustained traffic overloading a queue could crash the kernel.
  A source code patch exists which remedies this problem.

• 009: RELIABILITY FIX: November 5, 2026   All architectures
  With unveil(2), an obscure filesystem use could lock the kernel.
  A source code patch exists which remedies this problem.