CVE Feed

    Dashboard / CVE / CVE-2026-101302

    CVE-2026-101302

    TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).

    Published:Oct 15, 2026
    Last Modified:Oct 20, 2026
    EPS:Oct 15, 2026
    EPSS Score:0.00411
    CVSS Score:6.5

    Affected Products

    Vendor
    Freebsd
    Product
    Freebsd

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-101311 (CVSS 7) — The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB mo…
    CVE-2026-101310 (CVSS 7) — The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a …
    CVE-2026-101309 (CVSS 7) — The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size wa…
    CVE-2026-101308 (CVSS 5.5) — When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-m…
    CVE-2026-101307 (CVSS 8.2) — When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublin…
    CVE-2026-101303 (CVSS 7.5) — The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destinati…
    CVE-2026-101306 (CVSS 9.8) — SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A p…
    CVE-2026-101305 (CVSS 8.8) — renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a di…
    CVE-2026-101304 (CVSS 7.1) — When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that di…
    CVE-2026-58100 (CVSS 7) — kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High