A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| FreeBSD | FreeBSD | unknown |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 15 Oct 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 15 Oct 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS). | |
| Title | Remote DoS via receive-side kernel TLS | |
| Weaknesses | CWE-193 CWE-476 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: freebsd
Published:
Updated: 2026-10-15T13:55:00.760Z
Reserved: 2026-09-28T13:33:02.323Z
Link: CVE-2026-101302
Vulnrichment
Updated: 2026-10-15T13:54:47.947Z
NVD
Status : Received
Published: 2026-10-15T07:17:57.297
Modified: 2026-10-15T14:17:13.103
Link: CVE-2026-101302
Redhat
No data.
OpenCVE Enrichment
No data.