CVE-2026-101307: FreeBSD RACK Stack Buffer Overflow Flaw

CVE-2026-101307 Overview

CVE-2026-101307 is a heap-based buffer overflow [CWE-122] in the FreeBSD RACK TCP stack. The vulnerability stems from a 16-bit allocation counter that doubles each time the Per-Connection Metrics (PCM) sample array needs to grow. Repeated doublings wrap the counter to zero, producing a near-zero-length allocation. The RACK stack then copies the existing samples into the undersized buffer, resulting in an out-of-bounds write of approximately 512 KB in kernel heap memory. A remote attacker who can establish a TCP connection to an affected system can trigger the growth path by sending a sufficient number of ACKs, likely causing a kernel panic.

Critical Impact
Remote, unauthenticated attackers can corrupt the FreeBSD kernel heap over an established TCP connection, resulting in denial of service through kernel panic.

Affected Products

FreeBSD 15.1 (base release)
FreeBSD 15.1-p1 through 15.1-p4
Systems configured to use the RACK TCP stack

Discovery Timeline

2026-10-15 - CVE-2026-101307 published to the National Vulnerability Database
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-101307

Vulnerability Analysis

The FreeBSD RACK (Recent ACKnowledgment) TCP stack maintains an array of Per-Connection Metrics (PCM) samples for each established connection. When the array fills, the stack grows the backing buffer by doubling an allocation counter. That counter is stored in a 16-bit integer, giving it a maximum value of 65535 elements before it overflows.

After enough doublings, the counter wraps to zero. The next allocation request is sized against the wrapped value, producing a near-zero-length kernel heap buffer. The stack then copies the full existing PCM sample set into this undersized destination, writing roughly 512 KB past the end of the allocation.

The adjacent kernel heap metadata and neighboring allocations are overwritten. In practice this corrupts in-use kernel structures and triggers a panic, producing a reliable remote denial of service. The flaw sits in network-reachable code with no authentication requirement.

Root Cause

The root cause is an integer wrap in the growth logic of the PCM sample array. The developer used a 16-bit type for a counter that governs an unbounded doubling sequence. Mapping [CWE-122], the undersized allocation produces a classic heap buffer overflow when the subsequent copy proceeds using the pre-wrap element count.

Attack Vector

Exploitation requires only the ability to open a TCP connection to a listening service on the target. Once the connection is established, the remote peer sends a sustained stream of ACK segments. Each burst drives additional PCM samples and forces repeated array growth. After enough doublings, the counter wraps and the out-of-bounds write occurs during the next copy. No user interaction, credentials, or client-side cooperation are required.

See the FreeBSD Security Advisory SA-26:70 for technical details and patch references.

Detection Methods for CVE-2026-101307

Indicators of Compromise

Unexpected kernel panics on FreeBSD 15.1 hosts referencing the RACK TCP stack or tcp_rack symbols in the crash backtrace.
Core dumps showing corruption near PCM sample buffers in kernel heap zones.
Repeated TCP connection resets followed by host reboot cycles on exposed services.

Detection Strategies

Monitor FreeBSD kernel crash reports and /var/crash for panics correlated with inbound TCP traffic to RACK-enabled listeners.
Correlate network telemetry for TCP flows exhibiting unusually high ACK counts against a single long-lived connection.
Alert on sudden availability loss of FreeBSD servers that coincides with sustained inbound TCP sessions from a single remote peer.

Monitoring Recommendations

Enable kernel core dumps and configure centralized collection to analyze panic signatures after suspected exploitation.
Capture NetFlow or packet metadata at network edges to detect anomalous ACK volumes directed at FreeBSD hosts.
Track FreeBSD version and TCP stack configuration (net.inet.tcp.functions_default) in asset inventory to identify exposed systems.

How to Mitigate CVE-2026-101307

Immediate Actions Required

Apply the official FreeBSD patch referenced in FreeBSD-SA-26:70 to all FreeBSD 15.1 systems.
Inventory all hosts using the RACK TCP stack and prioritize internet-facing systems for immediate remediation.
Restrict inbound TCP access to affected services using host and network firewalls until patches are deployed.

Patch Information

FreeBSD has released fixes through the FreeBSD Security Advisory SA-26:70. Administrators should update FreeBSD 15.1 to the latest patch level using freebsd-update fetch install and reboot affected hosts. Confirm the kernel version after reboot to ensure the fix is loaded.

Workarounds

Switch the default TCP stack away from RACK by setting net.inet.tcp.functions_default=freebsd and ensuring existing sockets are reset.
Limit exposure of TCP services on FreeBSD 15.1 hosts to trusted network segments until the patch is installed.
Monitor for sustained inbound ACK volumes and terminate suspicious long-lived TCP sessions targeting RACK-enabled listeners.

bash

# Verify current default TCP stack and switch away from RACK
sysctl net.inet.tcp.functions_available
sysctl net.inet.tcp.functions_default=freebsd

# Persist across reboots
echo 'net.inet.tcp.functions_default=freebsd' >> /etc/sysctl.conf

# Apply vendor patches
freebsd-update fetch
freebsd-update install
shutdown -r now