-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-26:70.tcp                                        Security Advisory
                                                          The FreeBSD Project

Topic:          Remotely triggerable buffer overflow in tcp_rack

Category:       core
Module:         tcp_rack
Announced:      2026-10-14
Credits:        Raffaele Bova at Nozomi Networks Security Research
Affects:        FreeBSD 15.1
Corrected:      2026-10-14 16:02:55 UTC (stable/15, 15.1-STABLE)
                2026-10-14 16:04:34 UTC (releng/15.1, 15.1-RELEASE-p5)
CVE Name:       CVE-2026-101307

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

FreeBSD supports multiple pluggable TCP stacks.  The RACK stack
implements the Recent ACKnowledgment (RACK) loss detection algorithm
and is provided as the loadable kernel module tcp_rack.ko.  The RACK
stack includes a path capacity measurement (PCM) module that records
per-ACK samples in a dynamically growing array.

II.  Problem Description

When the PCM sample array needs to grow, the RACK stack doubles a
16-bit allocation counter.  Repeated doublings caused the counter to
wrap to zero, resulting in a near-zero-length allocation followed by a
copy of the existing samples into the undersized buffer.  A remote
peer can trigger the expansion by sending a sufficient number of ACKs
on an established connection.

III. Impact

A remote attacker who can establish a TCP connection to a system using the
RACK stack can trigger an out-of-bounds write of approximately 512 KB in
the kernel heap possibly resulting in a kernel panic.

IV.  Workaround

Systems that have not loaded the tcp_rack.ko kernel module are not
affected.  To check whether it is loaded, run:

# kldstat -m tcp_rack

The tcpsso(8) utility can be used to migrate existing TCP connections
to a different TCP stack.

V.   Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.

Perform one of the following:

1) To update your vulnerable system installed from base system packages:

Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:

# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"

2) To update your vulnerable system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-26:70/tcp.patch
# fetch https://security.FreeBSD.org/patches/SA-26:70/tcp.patch.asc
# gpg --verify tcp.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/15/                              57818a298ee1    stable/15-n286003
releng/15.1/                            5dd20a06fe9e  releng/15.1-n283633
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://www.cve.org/CVERecord?id=CVE-2026-101307>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:70.tcp.asc>
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwdkbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvxDcQANjx497pJcMBMEkbXX2y
GgWhda1BNnenRPuIzZGREXGrP/XvcWCe55lIqE5yf2j5OoDNLm8+N5bog8l/qawd
oK/M8FUdsoRawyr3PClHKinHYYhaHsLneih9RHeTbQEcyTHCyE+lbfOiE0+mMit3
I6F2Mj5K4m0bcCTyj52bjg+GgSZp0SWAlaEvg0FFBx5vAzql6BDPsPAO5Hz+3XmA
5OXz0feVLmAA9wqY/H8GVnZcK37ty80KAj/vNPpSiHFBimcl9GxyincukggpU0fH
si9G1aAgik6lyQtv78J1n/roLKajBr43isEeKRi10LgYTlUy8w6Qd/acCU20EDay
9Ent9TJizJp8RkTsygooAMZS+gq2jowBiOXqpEfFzQq1fk/T77QavE082yOSkXy8
x8NXk3QVH6A7Fmbse2At/pVvcIboJyBQrqWy6GPZibf20Q5Uv1mU/5yx7nd0vNW9
JGFNhgQybTTrGpm10C/HReuMchtEgduFnxZVQLCF9+5egg9sBrhXcHuo5KQgYJIy
UJDgEcvntvOKQiySZVMf0ICMsluSzLXqULX9RdpYlNJMM/4I3KRzW36tcgDQPAhn
rS4waz3LAThxbMHLrZBx9TlblpXKRWlbXJt2hjQnpS/4gpMEt9NfQmiihQDoBnWm
121Qq1WcQ6FEumRgnwN9jAZT
=9SEJ
-----END PGP SIGNATURE-----