CVE-2026-101307 Remotely triggerable buffer overflow in tcp_rack

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the...

CVE-2026-101307

The RACK stack (specifically the tcp_rack.ko kernel module) in FreeBSD 15.1 is vulnerable to a heap-based buffer overflow. When the PCM sample array needs to grow, the stack doubles a 16-bit allocation counter . Repeated doublings cause this counter to wrap to zero, leading to a near-zero-length ...

CVE-2026-101307 Remotely triggerable buffer overflow in tcp_rack

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the...

FreeBSD : FreeBSD -- Remotely triggerable buffer overflow in tcp_rack (e40e981e-c847-11f1-ada3-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e40e981e-c847-11f1-ada3-bc241121aa0a advisory. When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated...

FreeBSD Security Advisory - FreeBSD-SA-26:70.tcp

FreeBSD Security Advisory - Remotely triggerable buffer overflow in tcprack. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic...

FreeBSD -- Remotely triggerable buffer overflow in tcp_rack

Problem Description: When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer...

FreeBSD-SA-26:70.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:70.tcp Security Advisory The FreeBSD Project Topic: Remotely triggerable buffer overflow in tcprack Category: core Module: tcprack Announced: 2026-10-14...