What’s Vulnerable › Vulnerabilities
CVE-2026-101307: Remotely triggerable buffer overflow in tcp_rack
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-15 · updated 2026-10-20
- Weakness: CWE-122
Description
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
Affected products
- FreeBSD: 15.1, 15.1-p1, 15.1-p2, 15.1-p3, 15.1-p4
References
Get alerted when CVE-2026-101307 or the next vulnerability affects your stack