https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=284606
--- Comment #39 from [email protected] --- A commit in branch releng/14.3 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=c0cb68169bebc4210f9eccf643aeb73bf6d34654 commit c0cb68169bebc4210f9eccf643aeb73bf6d34654 Author: Kyle Evans <[email protected]> AuthorDate: 2025-11-01 17:34:11 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2025-12-16 13:57:34 +0000 ipfw: pmod: avoid further rule processing after tcp-mod failures m_pullup() here will have freed the mbuf chain, but we pass back an IP_FW_DENY without any signal that the outer loop should finish. Thus, rule processing continues without an mbuf and there's a chance that we conclude that the packet may pass (but there's no mbuf remaining) depending on the rules that follow it. PR: 284606 Reviewed by: ae Approved by: so Security: FreeBSD-SA-25:11.ipfw Security: CVE-2025-14769 (cherry picked from commit c0382512bfce872102d213b9bc2550de0bc30b67) (cherry picked from commit deb684f9d1d6a3681e451d3af31f768c567f7dbe) sys/netpfil/ipfw/pmod/tcpmod.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) -- You are receiving this mail because: You are on the CC list for the bug.
