CVE-2026-101307: Remotely triggerable buffer overflow in tcp_rack
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.
A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be able to establish a TCP connection to a system that is using the FreeBSD TCP RACK stack. They can then send enough ACKs on that established connection to trigger the vulnerable buffer expansion.
What impact is confirmed?
The flaw causes an out-of-bounds write of approximately 512 KB in kernel heap memory. The described possible outcome is a kernel panic.
Does exploitation require authentication or local access?
The described attack is remote and operates through ACKs on an established TCP connection. The available information does not state that authentication or local system access is required.