A high-severity flaw in the FreeBSD packet filter subsystem can cause security rules to be silently dropped, potentially resulting in unauthorized network access.

This vulnerability involves an incorrect hash calculation in the pf subsystem, which causes rules containing specific address range syntax to be discarded as duplicates. This flaw is unauthenticated, as it resides in the core packet filtering logic of the operating system.

The failure of the packet filter to load intended security rules directly undermines network segmentation and perimeter defense. Depending on the specific rules affected, this could lead to the unintended exposure of internal services or the denial of service for legitimate traffic. With a CVSS score of 7.5, this issue represents a significant risk to network integrity and compliance requirements.

Immediate Action: Administrators must update their FreeBSD systems to the patched versions provided in the FreeBSD-SA-26:09.pf security advisory.

Proactive Monitoring: Review current pf rule sets to identify if address range syntax is in use and verify that all rules are correctly loaded using the pfctl -sr command.

Compensating Controls: If immediate patching is not possible, audit firewall configurations to replace range-based syntax with CIDR blocks where applicable, as these remain unaffected by the regression.

Public Exploit Available: No (exploit_available: unknown)

Given the critical role of the packet filter in FreeBSD security, this regression poses a substantial risk to system isolation. Administrators are advised to prioritize the application of the vendor-supplied patches to ensure that all security policies are enforced as intended. Failure to remediate may leave network segments exposed due to the silent failure of security rules.