CVE-2026-101307
Freebsd: heap buffer overflow
- Risk score
- 64/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a suff…
- Affected
- Freebsd
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Freebsd: Amber, patch this week. SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to …
The flaws
- CVE-2026-101307: Heap buffer overflow (CVSS 9.1 · EPSS 0%)
- CVE-2026-101306: SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was… (CVSS 9.8 · EPSS 0%)
- CVE-2026-101305: Renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments (CVSS 8.8 · EPSS 0%)
- CVE-2026-101303: The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a… (CVSS 7.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Freebsd
Where it stands
- No known exploitation
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 399 other warnings in 30 days
- Same product: Earlier Freebsd warnings. 6 in the last 90 days
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
Last activity 15 Oct 2026. Patch Forecast updates every hour.