cve-2025-39682

CVE-2025-39682 exploit on kernelCTF mitigation instance This is also my first ? idk, this is a variant of CVE-2024-58239 1-day exploit. Patch: tls: fix handling of zero-length records on the rxlist This CVE was used in exp398 and and exp403. kernelCTF spreadsheet. For folder structures and how to...

CVE-2026-101302 Remote DoS via receive-side kernel TLS

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional...

CVE-2026-101302

The FreeBSD kernel's KTLS (Kernel TLS) module is vulnerable to a Remote Denial of Service (DoS) due to an off-by-one bug in the code that searches for the inner record type in TLS 1.3 decrypted payloads. A remote peer can trigger an underflow followed by an unconditional NULL pointer dereference ...

cve-2024-58239

exploit de mitigación CVE-2024-58239 Este es mi primer exploit de 1 día. Parche: tls: stop recv if initial processrxlist gave us non-DATA Vi exp407 en la hoja de cálculo de kernelCTF e intenté reproducir el exploit. Logré ejecutar el exploit en el entorno de kernelCTF y obtuve la bandera: Escribi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: tls: Handle the situation where data disappears from the TLS ULP. TLS assumes that it owns the receive queue of the TCP socket. This assumption cannot be guaranteed if the reader of the TCP socket entered before the TLS ULP was...

FreeBSD : FreeBSD -- Remote DoS via receive-side kernel TLS (36c2abd8-bcce-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 36c2abd8-bcce-11f1-906f-bc241121aa0a advisory. TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally...

FreeBSD Security Advisory - FreeBSD-SA-26:67.ktls

FreeBSD Security Advisory - Remote DoS via receive-side kernel TLS. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service DoS...

FreeBSD -- Remote DoS via receive-side kernel TLS

Problem Description: TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followe...

CVE-2026-64025

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter sockmap component when used with kernel TLS kTLS receive. A race condition exists where skpsockverdictdataready can improperly interact with the kTLS receive process. This can lead to a use-after-free vulnerability, potentially...

CVE-2026-64047

The CVE-2026-64047 issue is in the Linux kernel’s net: tls code, specifically an off-by-one in sg_chain entry counting for the wrapped sk_msg scatterlist ring. When sg.end

CVE-2026-64025

CVE-2026-64025 affects Linux kernel BPF plumbing where a TLS RX context could cause a use-after-free-like condition in data-path when a socket is inserted into a sockmap before TLS RX is configured. The issue arises because sk_psock_verdict_data_ready() does not guard against TLS RX ownership of ...

FreeBSD : FreeBSD -- Remote DOS via uninitialized memory access in KTLS receive (fb1bf2ae-74e2-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fb1bf2ae-74e2-11f1-958d-bc241121aa0a advisory. When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the...

FreeBSD-SA-26:46.ktls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:46.ktls Security Advisory The FreeBSD Project Topic: Remote DOS via uninitialized memory access in KTLS receive Category: core Module: ktls Announced:...

FreeBSD Security Advisory - FreeBSD-SA-26:46.ktls

FreeBSD Security Advisory - When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec...

CVE-2026-45257 Arbitrary file overwrite via the KTLS receive path

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile2, which can reference file-backed memory directly through non-anonymous MEXTPG pages or...

CVE-2026-45257 Arbitrary file overwrite via the KTLS receive path

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile2, which can reference file-backed memory directly through non-anonymous MEXTPG pages or...

EUVD-2026-39780

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile2, which can reference file-backed memory directly through non-anonymous MEXTPG pages or...

FreeBSD Kernel TLS Privilege Escalation

The vulnerability of the Kernel TLS KTLS technology in FreeBSD systems is related to inadequate control over resources throughout their entire lifecycle. Exploiting this vulnerability can allow attackers to enhance their privileges...

FreeBSD-SA-26:26.ktls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:26.ktls Security Advisory The FreeBSD Project Topic: Arbitrary file overwrite via the KTLS receive path Category: core Module: ktls Announced: 2026-06-09...

FreeBSD Security Advisory - FreeBSD-SA-26:26.ktls

FreeBSD Security Advisory - The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile2, which can reference file-backed memory directly through...