Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-101302

Freebsd: null pointer dereference can lead to denial of service

Risk score
46/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.4%
Published
15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer derefere…
Affected
Freebsd
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: FreebsdTHE FLAWSTHE FIXCVE-2026-101302Null pointer dereference canlead to denial of serviceCVSS 6.5 · EPSS 0%CVE-2026-101306SCM_RIGHTS file descriptorpassing did not preserveFD_RESOLVE_BENEATH when…CVSS 9.8 · EPSS 0%CVE-2026-101307Heap buffer overflowCVSS 9.1 · EPSS 0%CVE-2026-101305Renameat(2) did not enforceFD_RESOLVE_BENEATH on itsdirectory argumentsCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedFreebsdAMBER · PATCH THIS WEEKFreebsdSCM_RIGHTS file descriptorpassing did not preserveFD_RESOLVE_BENEATH when adescriptor was transferred. Aprocess could clear therestriction by sending thedescriptor to itself over a Unix…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-193 (CWE-193)9 other warnings in 30 days →Same productEarlier Freebsd warnings6 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freebsd: Amber, patch this week. SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to …

The flaws

  • CVE-2026-101302: Null pointer dereference can lead to denial of service (CVSS 6.5 · EPSS 0%)
  • CVE-2026-101306: SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-101307: Heap buffer overflow (CVSS 9.1 · EPSS 0%)
  • CVE-2026-101305: Renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Freebsd

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).

Last activity 15 Oct 2026. Patch Forecast updates every hour.