CVE-2026-101302 FreeBSD CVE debrief

Who should care

System administrators and security teams responsible for FreeBSD systems, particularly those using versions 15.1-RELEASE, 15.0-RELEASE, 14.5-RELEASE, and 14.4-RELEASE, should assess exposure and apply necessary patches or mitigations.

Why it matters

CVE-2026-101302 is a remote Denial of Service (DoS) vulnerability in FreeBSD's receive-side kernel TLS implementation. Defenders should verify exposure, apply patches, and monitor kernel activity to prevent and detect potential exploitation attempts.

• Verify exposure of FreeBSD systems to remote Denial of Service (DoS) attacks.
• Apply patches or mitigations to prevent exploitation.
• Monitor kernel activity for unusual behavior indicating potential exploitation attempts.
• Implement compensating controls to detect and respond to potential attacks.

Technical summary

The receive-side kernel TLS implementation in FreeBSD has an off-by-one bug in the record type search code. This can be triggered by a specially crafted TLS 1.3 record, leading to an underflow and unconditional NULL pointer dereference, causing a kernel panic. The vulnerability affects FreeBSD versions 15.1-RELEASE, 15.0-RELEASE, 14.5-RELEASE, and 14.4-RELEASE. Defenders should prioritize verifying exposure and applying patches or mitigations, focusing on these versions. Monitoring for unusual kernel activity and implementing compensating controls may be necessary.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, focusing on systems using FreeBSD 15.1-RELEASE, 15.0-RELEASE, 14.5-RELEASE, and 14.4-RELEASE. Monitoring for unusual kernel activity and implementing compensating controls may be necessary.

Recommended defensive actions

• Verify if FreeBSD systems are exposed by checking versions 15.1-RELEASE, 15.0-RELEASE, 14.5-RELEASE, and 14.4-RELEASE for patches or updates.
• Apply patches or mitigations provided by FreeBSD to address the vulnerability.
• Monitor kernel activity for unusual behavior that may indicate exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. The FreeBSD advisory offers vendor-specific guidance. Defenders should verify exposure by checking FreeBSD versions 15.1-RELEASE, 15.0-RELEASE, 14.5-RELEASE, and 14.4-RELEASE for patches or updates. The vulnerability details are based on the supplied source corpus, which may have limitations in scope and accuracy.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.