Remotely triggerable buffer overflow in tcp_rack
FreeBSD-SA-26:70.tcp · CVE-2026-101307
Our decision for FreeSense
FreeBSD corrected this on 2026-10-14, after the FreeBSD source pin of FreeSense 1.0 (pinned 2026-08-03), FreeSense 1.1 (pinned 2026-10-04), FreeSense 1.2 (pinned 2026-10-04). The fix arrives with the next FreeBSD pin of each line that is still updated. No one has checked yet whether FreeSense is exposed in practice.
- Advisory: corrected 2026-10-14
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | Open | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | Open | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | Open | 2026-10-04a52c50b4 |
Workaround
Systems that have not loaded the tcp_rack.ko kernel module are not affected. To check whether it is loaded, run: # kldstat -m tcp_rack The tcpsso(8) utility can be used to migrate existing TCP connections to a different TCP stack.
What FreeBSD says
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.
Impact
A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.