Out-of-Bounds Write Vulnerability in FreeBSD RACK Stack TCP Implementation

CVE-2026-101307

What is CVE-2026-101307?

This vulnerability arises when the PCM sample array in the RACK stack experiences a need for expansion, leading to an incorrect increment of a 16-bit allocation counter. This doubling can wrap the counter to zero, causing an erroneous allocation of a near-zero length. Consequently, when the system attempts to copy existing samples into this diminutive buffer, it can lead to an out-of-bounds write, potentially allowing a remote attacker to exploit the vulnerability by triggering the expansion through a sufficient number of ACK packets. Exploitation could result in a significant disruption, including a kernel panic impacting system stability.

References