Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101307— Remotely triggerable buffer overflow in tcp_rack

Quick assessment

Affected
FreeBSD FreeBSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当 PCM 样本数组需要扩容时，RACK 栈会将一个 16 位分配计数器加倍。重复的加倍操作导致该计数器回绕（wrap）为零，从而引发一个长度接近零的内存分配，随后将现有样本数据复制到该严重不足大小的缓冲区中。远程对端可以通过在已建立的连接上发送足够数量的 ACK 包来触发此扩容操作。 能够使用 RACK 栈与系统建立 TCP 连接的远程攻击者，可利用此漏洞在内核堆中触发一次约 512 KB 的越界写入，可能导致内核恐慌（kernel panic）。

AI Predicted 8.1 Difficulty: Easy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101307

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Remotely triggerable buffer overflow in tcp_rack
Source: CVE Program / CVE List V5
Vulnerability Description
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FreeBSD FreeBSD 15.1-RELEASE ~ p5 -

II. Public POCs for CVE-2026-101307

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101307

请登录查看更多情报信息。

Other References for CVE-2026-101307 (1)

Same Patch Batch · FreeBSD · 2026-10-15 · 13 CVEs total

CVE-2026-58099 Memory safety bugs in kqueue copy-on-fork implementation
CVE-2026-58098 Heap out-of-bounds access in semop(2)
CVE-2026-58100 Memory safety bugs in kqueue copy-on-fork implementation
CVE-2026-101302 Remote DoS via receive-side kernel TLS
CVE-2026-101306 Multiple jail filesystem root escapes
CVE-2026-101305 Multiple jail filesystem root escapes
CVE-2026-101304 Multiple jail filesystem root escapes
CVE-2026-101303 IPv6 UDP sendto(2) bypasses jail loopback restriction
CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap
CVE-2026-101311 Multiple vulnerabilities in bhyve device models
CVE-2026-101309 Multiple vulnerabilities in bhyve device models
CVE-2026-101310 Multiple vulnerabilities in bhyve device models

IV. Related Vulnerabilities

Same product: FreeBSD
Same vendor: FreeBSD
Same weakness: CWE-122

V. Comments for CVE-2026-101307

No comments yet

Leave a comment