{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101307", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-09-28T13:33:02.323Z", "datePublished": "2026-10-15T07:05:02.295Z", "dateUpdated": "2026-10-15T15:31:49.781Z"}, "containers": {"cna": {"datePublic": "2026-10-14T18:45:00.000Z", "title": "Remotely triggerable buffer overflow in tcp_rack", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["tcp"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "versionType": "release", "version": "15.1-RELEASE", "lessThan": "p5"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Raffaele Bova at Nozomi Networks Security Research"}], "descriptions": [{"lang": "en", "value": "When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.\n\nA remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}, {"cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-10-15T07:05:02.295Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T15:31:46.531780Z", "id": "CVE-2026-101307", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T15:31:49.781Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["tcp"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p5", "status": "affected", "version": "15.1-RELEASE", "versionType": "release"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.\n\nA remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic."}], "id": "CVE-2026-101307", "lastModified": "2026-10-15T07:17:57.890", "metrics": {}, "published": "2026-10-15T07:17:57.890", "references": [{"source": "[email protected]", "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Secondary"}]}

{}

{}