CVE-2026-101302
Undergoing Analysis Undergoing Analysis - In Progress

TLS 1.3 Record Parsing Kernel Panic in FreeBSD

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: FreeBSD

Description
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-101302
EUVD
EUVD-2026-101870

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
FreeBSD FreeBSD 15.1-RELEASE
FreeBSD FreeBSD 15.0-RELEASE
FreeBSD FreeBSD 14.5-RELEASE
FreeBSD FreeBSD 14.4-RELEASE

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a kernel panic issue in FreeBSD's Kernel TLS (KTLS) implementation for TLS 1.3. It occurs due to an off-by-one bug in code searching for the inner record type. An invalid TLS 1.3 frame can trigger an underflow, leading to a NULL pointer dereference and system crash. The issue only affects systems with receive-side KTLS enabled.

Detection Guidance

To detect if this vulnerability is present, check if receive-side Kernel TLS (KTLS) is enabled on your FreeBSD system by running: sysctl kern.ipc.tls.enable. If the value is 1, the system is potentially vulnerable. Additionally, monitor for kernel panics or unexpected system crashes during TLS 1.3 traffic.

Impact Analysis

This vulnerability allows a remote attacker to send a specially crafted TLS 1.3 record to trigger a kernel panic, causing a Denial of Service (DoS). The system will crash and require a reboot, disrupting services and availability.

Compliance Impact

This vulnerability causes a kernel panic leading to a Denial of Service (DoS), which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the availability of protected health information systems. Compliance may be impacted if systems fail to maintain required uptime or data access.

Mitigation Strategies

Immediately disable receive-side KTLS by setting kern.ipc.tls.enable to 0 via sysctl kern.ipc.tls.enable=0. Then apply the official patches from FreeBSD using pkg update && pkg upgrade or freebsd-update fetch install. Reboot the system after patching to ensure changes take effect.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart