FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Missing MAC validation in wg(4) packet decryption

Affected packages
15.1 <= FreeBSD-kernel < 15.1_2
15.0 <= FreeBSD-kernel < 15.0_12
14.4 <= FreeBSD-kernel < 14.4_8

Details

VuXML ID 3840a83e-8bb8-11f1-a6ab-bc241121aa0a
Discovery 2026-07-29
Entry 2026-07-30

Problem Description:

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag.

Impact:

A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel.

A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.

References

CVE Name CVE-2026-58085
FreeBSD Advisory SA-26:52.if_wg