Vulnerability · Published Oct 15, 2026 · Assigned by freebsd
CVE-2026-101307Remotely triggerable buffer overflow in tcp_rack
High 8.2
In plain English
A high-severity heap buffer overflow in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
Affected products (as reported)
Weakness: CWE-122, CWE-787 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc vendor-advisory