CVE-2026-101307

The RACK stack in FreeBSD (specifically the tcp_rack.ko kernel module) contains a remotely triggerable buffer overflow. The vulnerability exists because the PCM sample array doubles a 16-bit allocation counter when it needs to grow; repeated doublings cause the counter to wrap to zero, leading to...

FreeBSD -- Remotely triggerable buffer overflow in tcp_rack

Problem Description: When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer...

FreeBSD-SA-26:70.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:70.tcp Security Advisory The FreeBSD Project Topic: Remotely triggerable buffer overflow in tcprack Category: core Module: tcprack Announced: 2026-10-14...