CVE-2026-101307 is an integer-wraparound bug in FreeBSD's optional RACK TCP congestion-control stack that lets a remote peer, simply by sending enough ACKs on an established TCP connection, trigger an out-of-bounds write of about 512 KB into the kernel heap, most likely causing a kernel panic on systems that have the tcp_rack.ko module loaded.
Vulnerability summary
9.1
Critical
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-15
Published
Vulnerability ID: CVE-2026-101307 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| FreeBSD | cpe:2.3:o:freebsd:freebsd:15.1:*:*:*:*:*:*:* | 15.1-RELEASE before patch level p5 (RACK TCP stack, tcp_rack.ko module); fixed in stable/15 commit 57818a298ee1 and releng/15.1 commit 5dd20a06fe9e (2026-10-14) |
What this means
CVE-2026-101307 affects the RACK (Recent ACKnowledgment) TCP stack in FreeBSD, specifically its path-capacity-measurement (PCM) code. When the PCM sample array needs to grow, RACK doubles a 16-bit allocation counter; repeated doublings can wrap that counter to zero, which causes a near-zero-length buffer to be allocated and then overwritten with a copy of the existing (much larger) sample data. A remote attacker who can simply establish a TCP connection to a host running the RACK stack can trigger this expansion by sending a sufficient number of ACKs, producing an out-of-bounds write of approximately 512 KB in the kernel heap and "possibly resulting in a kernel panic" (FreeBSD-SA-26:70.tcp).
NVD performed its own analysis and assigned a CVSS v3.1 Primary score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, no confidentiality impact but high impact to integrity and availability (kernel memory corruption/crash). A separate Secondary CVSS v4.0 score of 8.2 is also recorded (NVD).
FreeBSD's advisory (FreeBSD-SA-26:70.tcp, dated 2026-10-14) states the bug affects FreeBSD 15.1-RELEASE, is corrected in stable/15 as of commit 57818a298ee1 and in releng/15.1 as of commit 5dd20a06fe9e (both dated 2026-10-14), and offers a workaround for systems that cannot immediately patch: avoid loading the tcp_rack.ko kernel module (checkable via kldstat -m tcp_rack), migrating any existing RACK-using connections off with the tcpsso(8) utility (FreeBSD-SA-26:70.tcp).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00313 (24.3th percentile), consistent with a very recently patched kernel bug that only affects systems that have explicitly enabled the non-default RACK TCP stack (FIRST EPSS). It is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Because RACK is not FreeBSD's default TCP stack, exposure is limited to hosts that have deliberately loaded tcp_rack.ko (common on systems tuned for high-throughput TCP path-capacity measurement); those hosts should patch to the corrected revisions or unload the module immediately given the low attack complexity and remote reachability.
Evidence
- Integer wraparound in RACK TCP's PCM sample-array growth logic causes a near-zero-length allocation followed by an out-of-bounds copy of ~512 KB into the kernel heap, remotely triggerable via ACKs on an established TCP connection. — FreeBSD-SA-26:70.tcp
- NVD Primary CVSS v3.1 base score is 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. — NVD
- Affects FreeBSD 15.1-RELEASE; fixed in stable/15 commit 57818a298ee1 and releng/15.1 commit 5dd20a06fe9e, both dated 2026-10-14; workaround is to avoid loading tcp_rack.ko and migrate connections with tcpsso(8). — FreeBSD-SA-26:70.tcp
- EPSS score is 0.00313 (24.3th percentile) as of 2026-10-30; not listed in CISA KEV. — FIRST EPSS
