Summary
generated automatically from NVD dataIn the FreeBSD RACK TCP stack, the 16-bit allocation counter used to grow the PCM sample array can wrap to zero after repeated doublings. This produces a near-zero-length allocation, and the existing samples are then copied into the undersized buffer. A remote peer that sends enough ACKs on an established connection can trigger this heap-based out-of-bounds write of roughly 512 KB in the kernel heap, possibly causing a kernel panic. The CVSS v3.1 score is 9.1 (CRITICAL).
NVD description
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
EPSS · FIRST.org
0.31%probability of exploitation in the next 30 days
Higher than 22% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 15 oct. 2026
- Updated
- 20 oct. 2026
- Status
- Analyzed
- Source
- secteam@freebsd.org
Affected products
Weaknesses (CWE)
References (1)
- https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.ascMitigationPatchVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-122
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.