Home / mailings FreeBSD Security Advisory FreeBSD-SA-26:70.tcp
Posted on 14 October 2026
FreeBSD security notificat=============================================================================FreeBSD-SA-26:70.tcp Security Advisory
The FreeBSD Project
Topic: Remotely triggerable buffer overflow in tcp_rack
Category: core
Module: tcp_rack
Announced: 2026-10-14
Credits: Raffaele Bova at Nozomi Networks Security Research
Affects: FreeBSD 15.1
Corrected: 2026-10-14 16:02:55 UTC (stable/15, 15.1-STABLE)
2026-10-14 16:04:34 UTC (releng/15.1, 15.1-RELEASE-p5)
CVE Name: CVE-2026-101307
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD supports multiple pluggable TCP stacks. The RACK stack
implements the Recent ACKnowledgment (RACK) loss detection algorithm
and is provided as the loadable kernel module tcp_rack.ko. The RACK
stack includes a path capacity measurement (PCM) module that records
per-ACK samples in a dynamically growing array.
II. Problem Description
When the PCM sample array needs to grow, the RACK stack doubles a
16-bit allocation counter. Repeated doublings caused the counter to
wrap to zero, resulting in a near-zero-length allocation followed by a
copy of the existing samples into the undersized buffer. A remote
peer can trigger the expansion by sending a sufficient number of ACKs
on an established connection.
III. Impact
A remote attacker who can establish a TCP connection to a system using the
RACK stack can trigger an out-of-bounds write of approximately 512 KB in
the kernel heap possibly resulting in a kernel panic.
IV. Workaround
Systems that have not loaded the tcp_rack.ko kernel module are not
affected. To check whether it is loaded, run:
# kldstat -m tcp_rack
The tcpsso(8) utility can be used to migrate existing TCP connections
to a different TCP stack.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.
Perform one of the following:
1) To update your vulnerable system installed from base system packages:
Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:
# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-26:70/tcp.patch
# fetch https://security.FreeBSD.org/patches/SA-26:70/tcp.patch.asc
# gpg --verify tcp.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch -E -p0 < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ 57818a298ee1 stable/15-n286003
releng/15.1/ 5dd20a06fe9e releng/15.1-n283633
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://www.cve.org/CVERecord?id=CVE-2026-101307>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:70.tcp.asc>
