FreeBSD: Remotely triggerable buffer overflow in tcp_rack
Summary
The RACK TCP stack of FreeBSD (loadable kernel module tcp_rack.ko) doubles a 16-bit allocation counter when its path capacity measurement sample array grows. After repeated doublings the counter wraps to zero, which leads to an undersized buffer and an out-of-bounds write of about 512 KB in the kernel heap. A remote peer can trigger this by sending enough ACKs on an established TCP connection, and no authentication is needed. The likely impact is a kernel panic, i.e. denial of service.
Affected
- FreeBSD 15.1-RELEASE before 15.1-RELEASE-p5 (per CVE record; the advisory lists FreeBSD 15.1)
- Only systems with the tcp_rack.ko module loaded are affected
- Older branches (14.x, 15.0) are not listed as affected in the advisory; whether they ship tcp_rack is unknown
- Default configuration: unknown
Fixed in
- stable/15 (15.1-STABLE): corrected 2026-10-14 16:02:55 UTC, commit 57818a298ee1
- releng/15.1 (15.1-RELEASE-p5): corrected 2026-10-14 16:04:34 UTC, commit 5dd20a06fe9e
Workaround
- Systems that have not loaded tcp_rack.ko are not affected; check with kldstat -m tcp_rack
- Migrate existing connections to another TCP stack with tcpsso(8)
- These are temporary measures only; patching is the proper fix
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact
- Not listed in the CISA KEV catalog
- No public proof of concept found at the time of research; recheck before relying on this
Our recommendation
- Inventory FreeBSD 15.1 systems, including firewalls, NAS devices and appliances
- Check whether tcp_rack.ko is loaded
- Update to 15.1-RELEASE-p5 or later and reboot, or unload the module as a temporary measure
- Prioritise internet-facing hosts where tcp_rack is loaded
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- FreeBSD-SA-26:70.tcp Security Advisory security.freebsd.org
- FreeBSD 15.1-RELEASE errata www.freebsd.org
- FreeBSD advisory (Vulners) vulners.com
- CVE-2026-101307 (Vulners) vulners.com
- CVE-2026-101307 (OpenCVE) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:10.
Original description (NVD)
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.