When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.
A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
References
| Link | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc | Mitigation Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Oct 2026, 00:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| First Time |
Freebsd freebsd
Freebsd |
|
| CPE | cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* |
|
| References | () https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc - Mitigation, Patch, Vendor Advisory |
15 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
15 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
15 Oct 2026, 07:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-15 07:17
Updated : 2026-10-20 00:21
NVD link : CVE-2026-101307
Mitre link : CVE-2026-101307
CVE.ORG link : CVE-2026-101307
JSON object : View
Products Affected
freebsd
- freebsd