14.5/relnotes: add the latest EN and SA

Approved by: re (implicit)
Differential Revision: https://reviews.freebsd.org/D59312

1 files changed, 50 insertions, 26 deletions

diff --git a/website/content/en/releases/14.5R/relnotes.adoc b/website/content/en/releases/14.5R/relnotes.adoc
index 118eca7dbf..cb46277f9a 100644
--- a/website/content/en/releases/14.5R/relnotes.adoc
+++ b/website/content/en/releases/14.5R/relnotes.adoc
@@ -15,7 +15,7 @@ include::shared/en/urls.adoc[]
 = FreeBSD {releaseCurrent} Release Notes
 :doctype: article
 :toc: macro
-:toclevels: 1
+:toclevels: 2
 :icons: font
 
 == Abstract
@@ -270,6 +270,26 @@ This section lists the various Security Advisories and Errata Notices since {rel
 | 29 July 2026
 | Race condition in ELF core dump segment counting
 
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:56.hwpmc.asc[FreeBSD-SA-26:56.hwpmc]
+| 25 August 2026
+| hwpmc fails to detach PMCs during exec credential transitions
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:58.sound.asc[FreeBSD-SA-26:58.sound]
+| 25 August 2026
+| Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:61.openssl.asc[FreeBSD-SA-26:61.openssl]
+| 25 August 2026
+| Multiple vulnerabilities in OpenSSL
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:62.tty.asc[FreeBSD-SA-26:62.tty]
+| 25 August 2026
+| Kernel use-after-free via tty ioctls
+
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-SA-26:63.posixshm.asc[FreeBSD-SA-26:63.posixshm]
+| 25 August 2026
+| TOCTOU race in POSIX shared memory large page configuration
+
 |===
 
 [[errata]]
@@ -318,6 +338,10 @@ This section lists the various Security Advisories and Errata Notices since {rel
 | 29 July 2026
 | Timezone database information update
 
+| link:https://www.FreeBSD.org/security/advisories/FreeBSD-EN-26:20.microcode.asc[FreeBSD-EN-26:20.microcode]
+| 25 August 2026
+| Early loading of Intel CPU microcode fails for some CPUs
+
 |===
 
 [[userland]]
@@ -328,32 +352,32 @@ This section covers changes and additions to userland applications, contributed
 [[userland-config]]
 === Userland Configuration Changes
 
-Local-unbound-setup now properly configures DNS resolution on IPv6-only systems by disabling unsupported protocols in the server configuration and using 127.0.0.1, ::1, or both in resolv.conf based on kernel support.
+Local-unbound-setup now properly configures DNS resolution on IPv6-only systems by disabling unsupported protocols in the server configuration and using 127.0.0.1, ::1, or both in [.filename]#resolv.conf# based on kernel support.
 gitref:973d1f2b12ab[repository=src].
 
-The /etc/protocols file has been updated with the latest IANA assignments, including documentation of unassigned and deprecated protocols.
+The [.filename]#/etc/protocols# file has been updated with the latest IANA assignments, including documentation of unassigned and deprecated protocols.
 gitref:9f9f0d3d9e1c[repository=src].
 
-The man:lpd[8] daemon now correctly uses the port number specified in /etc/printcap instead of ignoring it, restoring a feature broken since the addition of IPv6 support in 2000.
+The man:lpd[8] daemon now correctly uses the port number specified in [.filename]#/etc/printcap# instead of ignoring it, restoring a feature broken since the addition of IPv6 support in 2000.
 gitref:85852fe5e4a9[repository=src].
 
 [[userland-programs]]
 === Userland Application Changes
 
-The rc.firewall script now supports reading IP addresses or subnets from on-disk files for the firewall_allowservices and firewall_trusted list variables. Elements that look like absolute paths are read line by line, skipping comments and blank lines, and the first word on each line is treated as an address or subnet.
+The [.filename]#rc.firewall# script now supports reading IP addresses or subnets from on-disk files for the `firewall_allowservices` and `firewall_trusted` list variables. Elements that look like absolute paths are read line by line, skipping comments and blank lines, and the first word on each line is treated as an address or subnet.
 gitref:10075baae2c1[repository=src].
 
-The default history size in /bin/sh has been increased from 100 to 128, complying with the POSIX.1-2024 minimum requirement.
+The default history size in man:sh[1] has been increased from 100 to 128, complying with the POSIX.1-2024 minimum requirement.
 gitref:9bc3d8e002b9[repository=src].
 
-LTO-10 and LTO-10P density codes and cartridge specifications have been added to mt(1) and libmt, enabling detection and reporting of the new tape formats.
+LTO-10 and LTO-10P density codes and cartridge specifications have been added to man:mt[1] and libmt, enabling detection and reporting of the new tape formats.
 gitref:5f55c59cbab5[repository=src].
 {{< sponsored "Spectra Logic" >}}
 
 The default behavior of man:pwd[1] has changed from -P to -L, aligning with POSIX semantics.
 gitref:ae75d4bdc12b[repository=src].
 
-The ipfw(8) binary now includes a fallback mechanism to support the new kernel interface introduced in FreeBSD 15.0. When running with a 15.0+ kernel, ipfw(8) automatically invokes a bundled ipfw15 binary to load firewall rules, ensuring compatibility during upgrade procedures.
+The man:ipfw[8] binary now includes a fallback mechanism to support the new kernel interface introduced in FreeBSD 15.0. When running with a 15.0+ kernel, ipfw(8) automatically invokes a bundled ipfw15 binary to load firewall rules, ensuring compatibility during upgrade procedures.
 gitref:704ec5e68c44[repository=src].
 
 The man:daemon[8] utility now supports the -m option to specify the output file mode, allowing non-root log collectors to access log files.
@@ -436,10 +460,10 @@ gitref:b734006cafa1[repository=src].
 [[userland-libraries]]
 === Runtime Libraries and API
 
-The sortlist parser in libc's resolver has been reimplemented, restoring the ability to configure address sort order in /etc/resolv.conf. Sorting of IPv4 and IPv6 addresses is now functional again, with updated documentation.
+The sortlist parser in libc's resolver has been reimplemented, restoring the ability to configure address sort order in [.filename]#/etc/resolv.conf#. Sorting of IPv4 and IPv6 addresses is now functional again, with updated documentation.
 gitref:fc00e7a18cde[repository=src].
 
-The libc resolver option parser now strictly validates option names and values, rejecting trailing garbage, negative values, and non-numeric arguments, which changes behavior for malformed resolv.conf options.
+The libc resolver option parser now strictly validates option names and values, rejecting trailing garbage, negative values, and non-numeric arguments, which changes behavior for malformed [.filename]#resolv.conf# options.
 gitref:b52d95bf1494[repository=src].
 
 C23-standard trigonometric functions using the pi multiplier (such as sinpi, cospi, and related variants) are now exposed in <math.h>. This extends the available math library APIs to align with the C23 standard.
@@ -477,17 +501,17 @@ This section covers changes and additions to devices and device drivers since {r
 [[drivers-device]]
 === Device Drivers
 
-The br.lenovo.kbd keyboard layout is now installed and available in the system.
+The `br.lenovo.kbd` keyboard layout is now installed and available in the system.
 gitref:ca42bd490891[repository=src].
 
-The US international keyboard layout with accented keys us.intl.acc.kbd is now installed by default and available in the system.
+The US international keyboard layout with accented keys `us.intl.acc.kbd` is now installed by default and available in the system.
 gitref:823889aaafa3[repository=src].
 
 The man:smartpqi[4] driver has been updated with new controller support and a 32-bit I/O buffer size for passthrough ioctls, replacing the previous 16-bit limit.
 gitref:8accd4d99f81[repository=src].
 {{< sponsored "Microchip Technology Inc." >}}
 
-The man:acpi[4] driver now supports power management on Apple Mac hardware with dual GPUs by enabling the Darwin OSI by default, which uses the integrated GPU for improved battery life. This behavior can be toggled with the tunable hw.acpi.apple_darwin_osi.
+The man:acpi[4] driver now supports power management on Apple Mac hardware with dual GPUs by enabling the Darwin OSI by default, which uses the integrated GPU for improved battery life. This behavior can be toggled with the tunable `hw.acpi.apple_darwin_osi`.
 gitref:964c97aa80ec[repository=src].
 
 The man:ahci[4] driver now supports an additional Marvell 88SE9128 SATA controller variant (device ID 0x91a3), enabling proper operation on systems with this chip (e.g., Gigabyte GA-P55A-UD4 motherboards).
@@ -518,19 +542,16 @@ This section covers the boot loader, boot menu, and other boot-related changes.
 [[boot-loader]]
 === Boot Loader Changes
 
-The lualoader now supports be-list and be-switch commands, allowing boot environment changes from the loader command prompt.
-gitref:bddfcbd9bbc6[repository=src].
-
 Fixed a boot loader bug in man:loader.efi[8] for amd64 where late staging area movement after page table computation could cause boot failures, particularly when loading microcode or a large set of modules.
 gitref:8dca7fccfa65[repository=src].
 {{< sponsored "Netflix" >}}
 
-The boot loader's Lua scripting now supports filtering the list of boot environments via a user-defined callback in local.lua, allowing operators to hide certain BEs (e.g., those with a leading dot).
-gitref:9ef671ef0c6c[repository=src].
+Boot loader on powerpc64le works around a SLOF bug in QEMU by adding padding, fixing booting on little-endian PowerPC systems.
+gitref:5d2b9a17b9c6[repository=src].
+{{< sponsored "Netflix" >}}
 
-The loader now prefers the embedded memory disk as the current device when built with MD_IMAGE_SIZE, improving boot behavior for such configurations.
-gitref:a4a3825d3e1d[repository=src].
-{{< sponsored "Chelsio Communications" >}}
+The lualoader now supports be-list and be-switch commands, allowing boot environment changes from the loader command prompt.
+gitref:bddfcbd9bbc6[repository=src].
 
 The boot loader's Lua core now follows symlinks when searching for bootable kernels.
 gitref:1841091eaa0b[repository=src].
@@ -538,17 +559,20 @@ gitref:1841091eaa0b[repository=src].
 man:bsdinstall[8] now correctly creates a FreeBSD UEFI boot entry after installation, fixing a regression where some machines could not boot due to a missing boot entry.
 gitref:cfdd90abab51[repository=src].
 
+The boot loader's Lua scripting now supports filtering the list of boot environments via a user-defined callback in local.lua, allowing operators to hide certain BEs (e.g., those with a leading dot).
+gitref:9ef671ef0c6c[repository=src].
+
+The loader now prefers the embedded memory disk as the current device when built with MD_IMAGE_SIZE, improving boot behavior for such configurations.
+gitref:a4a3825d3e1d[repository=src].
+{{< sponsored "Chelsio Communications" >}}
+
 The ZFS rc script now runs before the tmp rc script, ensuring ZFS datasets (including a /tmp dataset) are mounted before tmp attempts to test writability and possibly mount a tmpfs. This fixes issues with read-only ZFS roots and the `tmpmfs=yes` setting.
 gitref:b39cac4b834c[repository=src].
 
-Boot loader on powerpc64le works around a SLOF bug in QEMU by adding padding, fixing booting on little-endian PowerPC systems.
-gitref:5d2b9a17b9c6[repository=src].
-{{< sponsored "Netflix" >}}
-
 Fix for handling of foreground and background color settings in the loader's graphical console environment, ensuring that the environment can set either independently and that colors are correctly applied when switching to the kernel.
 gitref:14c8e003318b[repository=src].
 
-Nvidia kernel modules are now blacklisted by the loader to prevent panics if loaded early via loader.conf. The nvidia, nvidia-modeset, and nvidia-drm modules are denied loading at boot time.
+Nvidia kernel modules are now blacklisted by the loader to prevent panics if loaded early via [.filename]#loader.conf#. The nvidia, nvidia-modeset, and nvidia-drm modules are denied loading at boot time.
 gitref:7db1376bd151[repository=src].
 
 The boot logo positions for Beastie and fbsdbw have been corrected.