CVE-2026-49423: FreeBSD KTLS CBC Decryption DoS Vulnerability

CVE-2026-49423 Overview

CVE-2026-49423 is an uninitialized memory use vulnerability [CWE-908] in the FreeBSD kernel TLS (ktls) subsystem. The flaw resides in ktls_ocf_tls_cbc_decrypt(), which builds an iovec array while processing received TLS 1.2 CBC records. The function increments the iovec index for every mbuf in the chain, including header-only mbufs that are supposed to be skipped. Because the iovec array is allocated without zeroing, this leaves uninitialized entries that the kernel later reads during HMAC computation. A remote TLS peer that can control TCP segmentation can trigger a kernel panic.

Critical Impact
A remote TLS peer able to shape TCP segmentation so the first mbuf of a CBC record contains only the 5-byte TLS header can cause a kernel panic, resulting in denial of service.

Affected Products

FreeBSD operating system
Kernel TLS (ktls) subsystem processing TLS 1.2 CBC records
Systems relying on ktls_ocf_tls_cbc_decrypt() for inbound TLS decryption

Discovery Timeline

2026-08-19 - CVE-2026-49423 published to NVD
2026-08-19 - Last updated in NVD database
2026-08-20 - EPSS scoring published

Technical Details for CVE-2026-49423

Vulnerability Analysis

The FreeBSD kernel TLS subsystem processes inbound TLS records without moving payload data into userspace. For TLS 1.2 records using Cipher Block Chaining (CBC) mode, ktls_ocf_tls_cbc_decrypt() constructs an iovec array describing the mbuf chain that holds the record. The function iterates through each mbuf, skipping mbufs that carry only the 5-byte TLS record header. Despite skipping those mbufs for data population, the code still increments the iovec index. The resulting iovec array contains stale entries at indices meant to remain unused. Downstream code performing the Hash-based Message Authentication Code (HMAC) calculation reads those stale entries as if they were valid, dereferencing arbitrary pointers and lengths from kernel stack or heap memory.

Root Cause

The root cause is twofold. First, the iovec array is allocated without zeroing, so uninitialized entries hold whatever memory was previously present. Second, ktls_ocf_tls_cbc_decrypt() advances the iovec index for skipped header-only mbufs, creating gaps that are never populated but are later consumed. The combination allows uninitialized memory to be interpreted as scatter-gather descriptors during cryptographic processing.

Attack Vector

Exploitation requires an attacker acting as the remote TLS peer of a FreeBSD host using kernel TLS for receive offload with TLS 1.2 CBC ciphersuites. The attacker must control TCP segmentation so that the first mbuf of a CBC record contains only the 5-byte TLS record header, with payload arriving in subsequent mbufs. When ktls processes that record, uninitialized iovec entries are read during HMAC computation, panicking the kernel and taking the host offline.

No verified exploitation code is publicly available. Refer to the FreeBSD Security Advisory for authoritative technical detail.

Detection Methods for CVE-2026-49423

Indicators of Compromise

Unexpected kernel panics on FreeBSD hosts terminating inbound TLS 1.2 CBC sessions with kernel TLS enabled
Crash dumps referencing ktls_ocf_tls_cbc_decrypt or HMAC processing paths in the ktls call stack
Repeated abnormal TCP segmentation patterns from a single remote peer preceding a host crash

Detection Strategies

Inventory FreeBSD hosts with kernel TLS enabled and identify services that negotiate TLS 1.2 CBC ciphersuites
Correlate host reboot or panic events with concurrent TLS connections from external peers
Inspect crash dumps for faulting addresses in the ktls receive path and preserve them for vendor analysis

Monitoring Recommendations

Monitor kernel logs and /var/crash for panics that reference ktls symbols
Alert on repeated unexpected reboots of FreeBSD systems serving TLS traffic
Track TLS ciphersuite negotiation to identify systems still permitting CBC modes

How to Mitigate CVE-2026-49423

Immediate Actions Required

Apply the FreeBSD security patch referenced in FreeBSD-SA-26:46.ktls as soon as it is available for your release
Disable kernel TLS receive offload on affected hosts until patches are installed
Restrict TLS 1.2 CBC ciphersuites on affected services and prefer AEAD ciphersuites such as AES-GCM or ChaCha20-Poly1305

Patch Information

FreeBSD has published the advisory FreeBSD-SA-26:46.ktls describing the fix. Administrators should follow the advisory to obtain the corrected kernel packages or source patches and rebuild affected systems.

Workarounds

Disable kernel TLS for receive processing where operationally acceptable
Reconfigure TLS-terminating services to advertise only AEAD ciphersuites, avoiding the vulnerable CBC path
Place vulnerable hosts behind a TLS-terminating proxy that is not affected by the ktls flaw

bash

# Example: prefer AEAD ciphersuites and remove CBC from an OpenSSL-based service
# (adjust for your service's configuration syntax)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;