Quick answers
- Is CVE-2026-101302 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-101302 being exploited in the wild.
- How severe is CVE-2026-101302?
- Medium severity, with a CVSS score of 6.5, published 15 October 2026.
- Which products and versions are affected?
- Freebsd 14.4, 14.5, 15.0, 15.1 and all supported versions prior to the correction date.
- Is there a fix for CVE-2026-101302?
- Yes: fixed in FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, and later stable/releng branches. Until then: Disable kernel TLS by setting kern.ipc.tls.enable sysctl to 0 if receive-side KTLS is not required for your application workload. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-101302 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-101302?
- Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, and later stable/releng branches
Disable kernel TLS by setting kern.ipc.tls.enable sysctl to 0 if receive-side KTLS is not required for your application workload.
Technical details
The receive-side KTLS implementation searches for the inner record type byte in TLS 1.3 decrypted payloads but contains an off-by-one bug that allows an underflow condition when processing certain invalid frames, leading to a NULL pointer dereference. A remote TLS 1.3 peer can trigger this via network without authentication, causing immediate kernel panic on systems with KTLS enabled.
Affected products
- FreeBSD FreeBSD 14.4, 14.5, 15.0, 15.1 and all supported versions prior to the correction date
Timeline
- 2026-09-29: disclosed
- 2026-09-28: patched