Vulnerability in FreeBSD

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.1

[ Description ]Official description

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.

[ Fixes ]Fixes and patches

• Patch on security.freebsd.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0452

  Vulnerabilities fixed in FreeBSD bhyve hypervisor Translated from Dutch

  Probability/damage M/HCVE-2026-101307CVE-2026-101308CVE-2026-101309+2 more CVEs
• BSI CERT-Bund14 Oct 2026WID-SEC-2026-3967

  FreeBSD Project FreeBSD OS: Multiple vulnerabilities Translated from German

  CVE-2026-101311CVE-2026-101307CVE-2026-101308+2 more CVEs

[ References ]References

• security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.ascMitigationPatchVendor Advisory