{"schema":"threatline.record/2","record":{"id":"CVE-2026-101307","aliases":[],"summary":"Remotely triggerable buffer overflow in tcp_rack","details":"When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.  Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer.  A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.\n\nA remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.","categories":["Operating systems"],"product":"FreeBSD","vendor":"FreeBSD","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101307","source_modified_at":"2026-10-15T16:48:11.023Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"FreeBSD","vendor":"FreeBSD","versions":[{"status":"affected","versionType":"release","version":"15.1-RELEASE","lessThan":"p5"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00313,"percentile":0.23033,"score_date":"2026-10-23"},"published_at":"2026-10-15T07:05:02.295Z","modified_at":"2026-10-15T16:48:11.023Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-101307","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T16:48:11.023Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101307","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T15:31:46.531780Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T16:48:11.023Z","content_hash":"e1cabbb3e171f662f6e42fa45c982f8b71735b3f3921cca71e66514d360ecbdc"}}