-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-26:27.tcp Errata Notice
The FreeBSD Project
Topic: TCP timers may overflow and fire late or not at all
Category: core
Module: tcp
Announced: 2026-10-14
Credits: Lukas Book
Affects: FreeBSD 15.1 and 14.4
Corrected: 2026-08-06 09:07:02 UTC (stable/15, 15.1-STABLE)
2026-10-14 16:04:33 UTC (releng/15.1, 15.1-RELEASE-p5)
2026-08-06 05:55:09 UTC (stable/14, 14.5-PRERELEASE)
2026-10-14 16:03:51 UTC (releng/14.4, 14.4-RELEASE-p11)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
.
I. Background
Each TCP connection maintains a set of timers, covering retransmission,
persist, keepalive, 2MSL (TIME_WAIT and FIN_WAIT_2), and delayed ACK.
Since FreeBSD 14.0, the default TCP stack multiplexes all of these timers
onto a single callout(9) per connection. Whenever a timer is started or
stopped, the stack selects the earliest pending timer, together with the
allowed scheduling precision, and reschedules the callout accordingly.
A stopped timer is marked by setting its expiry time to SBT_MAX.
II. Problem Description
When a timer was stopped, its previously computed precision was left in
place. While selecting the next timer to schedule, the stack added that
precision to the SBT_MAX expiry of the stopped timer, causing a signed
integer overflow. The resulting negative value was then used to compute
the precision passed to callout(9) for the connection's callout.
III. Impact
The per-connection callout may be scheduled with an invalid precision,
causing TCP timers to run far later than intended. Affected connections
may fail to retransmit, send keepalives, or leave TIME_WAIT and FIN_WAIT_2
in a timely manner, and can remain in the connection table indefinitely,
consuming memory, protocol control blocks, and local ports.
Affected connections can be recognized by negative or implausibly large
values in the timer columns (rexmt, persist, keep, 2msl, delack) reported
by "netstat -nxptcp".
Only connections using the default FreeBSD TCP stack are affected.
IV. Workaround
Affected connections can be listed with netstat(1) and terminated with
tcpdrop(8). The following prints the local and foreign endpoints of all
connections with a negative value in any of the rexmt, persist, keep,
2msl, or delack timer columns:
# netstat -nxptcp | \
awk 'NR > 2 && ($14 < 0 || $15 < 0 || $16 < 0 || $17 < 0 || $18 < 0) \
{ print $4, $5 }'
Review the output, then drop each connection by passing the two endpoints
exactly as printed to tcpdrop(8), which accepts the netstat(1) address
format directly, for example:
# tcpdrop 192.0.2.1.80 198.51.100.7.53211
Note that connections whose timers have been deferred without becoming
negative are not detected by this method, and that dropping a connection
resets it for the peer.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date, and reboot the system.
Perform one of the following:
1) To update your system installed from base system packages:
Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:
# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for an erratum fix"
2) To update your system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for an erratum fix"
3) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-26:27/tcp.patch
# fetch https://security.FreeBSD.org/patches/EN-26:27/tcp.patch.asc
# gpg --verify tcp.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch -E -p0 < /path/to/patch
c) Recompile your kernel as described in
and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ e8d1cee43741 stable/15-n284741
releng/15.1/ cf95af02eb15 releng/15.1-n283632
stable/14/ 85485a570d4f stable/14-n274777
releng/14.4/ 11f0c61eecb8 releng/14.4-n273783
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat
Or visit the following URL, replacing NNNNNN with the hash:
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwdcbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvwe8P/jP7gDz4gtYvhzd4W2v2
v02GxryG8zdoHTRdNh2T4ZGXrg1vLRCuINZazJWtZKXpWHTnFXluUXimpB6Gk8oP
yBix+d/vgdB7H4OWkSn9PFqEcTtLDLxdLgVdyfYjugqG3hKE86op724sujWbcyKg
mKjZNyk29NqXrH0gGiU/KzOI6iwHmsxJMeglk4Yw7z4cFf+NNslhZlKnH241aI1x
SCTwm6vT8mdFc6h6vHQ77IMnNCzsGY8/BN3OtcCaFijB4gU/VsplwiZC3r+cUmnF
aZLeabLGcmT1xemR4nDssI+qAc9+f6fuEi/enWoZFH6ZA8OFq6YubR9vjBQeslGW
EApxRD/HoURuSwZCKwET7B6CZSWVeuGQya8bG86PbXDjAXQUhI7kG4LTFAkHAqoq
zllJYxmKvBU3fZnJrcbVGD/39cMZ9XZYfEOfCrHMpCU0z+H2F7Q0TP88xRecbVsE
0Khk3CA8hdqHn7qKzgNHrGJ8jwNGZ8ms9+QIXtUeirSQGBK1gOwNFyf2ehwmo8S1
kb6FjcanX50PIJGKV3XMtyUBQFuBKxNxI/L/wjUUgCwcMTM8WEGjrTECO1O2+1ZX
xhKf4WmiMy8cyoIqmCyzdcKtHYegVzpqr1XWjasYunAmKcyJVeQV02VBlB5TDc3I
TIuOY6BPvFsN/4AOoY7eo0vy
=Fmg2
-----END PGP SIGNATURE-----