# CVE-2026-101307: FreeBSD RACK stack buffer overflow in tcp_rack

Source: https://junglewise.ai/threats/cve-2026-101307-when-the-pcm-sample-array-needs-to-grow-the-rack-stack-doubles-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-101307 · Severity: critical · CVSS 9.1 · Published 2026-10-15

The RACK TCP stack module in FreeBSD contains a buffer overflow in its path capacity measurement component. A remote attacker can trigger the vulnerability by sending specially crafted TCP acknowledgments on an established connection, causing approximately 512 KB of kernel heap corruption that may result in a system crash. This affects systems that have the tcp_rack kernel module loaded.

Technologies: [Freebsd](https://junglewise.ai/threats/technologies/freebsd). Vendors: [Freebsd](https://junglewise.ai/threats/vendors/freebsd).

## Quick answers

**Is CVE-2026-101307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101307 being exploited in the wild.

**How severe is CVE-2026-101307?** Critical severity, with a CVSS score of 9.1, published 15 October 2026.

**Which products and versions are affected?** Freebsd 15.1.

**Is there a fix for CVE-2026-101307?** Yes: fixed in FreeBSD 15.1-RELEASE-p5, stable/15 as of 2026-10-14. Until then: Unload the tcp_rack kernel module on systems where the RACK stack is not required. Run 'kldstat -m tcp_rack' to verify if the module is loaded. The tcpsso(8) utility can migrate existing TCP connections to an alternative TCP stack.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"},{"kind":"patched","at":"2026-10-14"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101307 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-101307?** Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FreeBSD 15.1-RELEASE-p5, stable/15 as of 2026-10-14

Unload the tcp_rack kernel module on systems where the RACK stack is not required. Run 'kldstat -m tcp_rack' to verify if the module is loaded. The tcpsso(8) utility can migrate existing TCP connections to an alternative TCP stack.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"},{"kind":"patched","at":"2026-10-14"}]

## Technical details

The vulnerability exists in the RACK stack's PCM sample array expansion logic, which uses a 16-bit allocation counter that doubles to grow the array. Repeated doublings cause integer overflow and wraparound to zero, resulting in a vastly undersized heap allocation followed by an out-of-bounds copy of the original samples. A remote peer with an established TCP connection can trigger repeated array expansions by sending sufficient ACKs, leading to kernel heap corruption and potential denial of service.

## Affected products

- FreeBSD FreeBSD 15.1

## References

- [https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc](https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc)

## Related threats

- [FreeBSD kqueue out-of-bounds read in fork copy](https://junglewise.ai/threats/cve-2026-58100-kqueue-fork-copy-knote-indexed-into-the-child-s-file-descriptor)
- [FreeBSD kernel kqueue memory safety bugs in copy-on-fork](https://junglewise.ai/threats/cve-2026-58099-when-copying-knotes-from-a-parent-kqueue-to-a-child-the-copy-code)
- [FreeBSD kernel heap out-of-bounds access in semop(2)](https://junglewise.ai/threats/cve-2026-58098-when-semop-2-blocks-waiting-for-a-semaphore-condition-it-releases)
- [FreeBSD sound(4) use-after-free in buffer resize TOCTOU race](https://junglewise.ai/threats/cve-2026-101308-when-an-audio-channel-s-buffer-needs-to-be-resized-the-sound-4)
- [FreeBSD jail filesystem root escape via SCM_RIGHTS](https://junglewise.ai/threats/cve-2026-101306-scm-rights-file-descriptor-passing-did-not-preserve-fd-resolve)