TLS 1.2 CBC Record Handling Error in FreeBSD Kernel

CVE-2026-49423

What is CVE-2026-49423?

The vulnerability arises during the construction of the iovec array for received TLS 1.2 CBC records within the FreeBSD kernel. Specifically, the function ktls_ocf_tls_cbc_decrypt() improperly increments the iovec index for each mbuf in the chain, including those that solely consist of TLS header bytes and should be excluded. This mishandling results in uninitialized entries within the iovec array, which, when accessed during HMAC computation, can trigger a kernel panic. An attacker capable of controlling TCP segmentation can exploit this behavior by ensuring that the first mbuf of a CBC record contains only the 5-byte TLS header, ultimately compromising system stability.

References