CVE-2026-49423 in FreeBSD
Summary
by MITRE • 08/19/2026
When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was allocated without zeroing.
A remote TLS peer can cause the kernel to read from uninitialized iovec entries during HMAC computation, resulting in a kernel panic. The peer must be able to control TCP segmentation such that the first mbuf of a CBC record contains only the 5-byte TLS record header.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability described involves a critical memory safety flaw within the FreeBSD kernel's implementation of TLS 1.2 decryption using hardware acceleration via ktls_ocf_tls_cbc_decrypt. The core issue stems from an incorrect iteration logic when constructing the iovec array, which is used to pass data buffers to cryptographic operations. Specifically, during the processing of a received TLS record with Cipher Block Chaining mode, the function increments the index for every mbuf in the network packet chain without verifying whether that specific mbuf contains actual payload data or merely header bytes. In scenarios where TCP segmentation results in an initial mbuf containing only the five-byte TLS record header, this logic erroneously advances the iovec pointer past valid entries, leaving subsequent slots in the array uninitialized. Because the memory for the iovec structure is allocated without being zeroed out beforehand, these uninitialized slots contain arbitrary data from previous kernel operations or stack remnants rather than null pointers or defined values.
This architectural flaw leads to a severe operational impact when the cryptographic subsystem attempts to compute the Hash-based Message Authentication Code HMAC. The hardware acceleration engine reads from all entries in the iovec array as specified by its length, including those uninitialized slots that were incorrectly populated due to the indexing error. Accessing these memory regions constitutes an out-of-bounds read or use of uninitialized kernel memory. Since this operation occurs within a privileged context and involves sensitive cryptographic processing, the result is typically immediate system instability. A remote attacker who can influence TCP segmentation patterns to force such malformed packet structures into the TLS stack can trigger this condition remotely. The consequence is a kernel panic, effectively resulting in a Denial of Service against any host running the affected FreeBSD version that accepts incoming TLS 1.2 connections using hardware acceleration for CBC ciphersuites.
From a classification perspective, this vulnerability aligns with CWE-457, which describes the use of an uninitialized variable, and more specifically relates to improper initialization of data structures leading to information exposure or system crashes. In terms of attack vectors, it falls under CWE-120 Buffer Overflow if one considers the potential for memory corruption, though in this specific instance, the primary manifestation is a crash due to invalid memory access during cryptographic computation. The ATT&CK framework categorizes such behavior under Tactic TA0004 Impact and Technique T1499 Endpoint Denial of Service, as the attacker leverages a software flaw to disrupt service availability rather than gaining unauthorized access or exfiltrating data directly through this specific vector.
Mitigation strategies must address both immediate remediation and long-term defensive coding practices. The primary solution is for vendors to apply patches that correct the loop logic within ktls_ocf_tls_cbc_decrypt to ensure that only mbufs containing actual payload data are included in the iovec array construction. Developers should implement bounds checking or conditional increments based on whether an mbuf contributes meaningful bytes to the cryptographic input rather than incrementing blindly for every segment in the chain. Additionally, enforcing strict memory initialization practices by zeroing out allocated structures before use can prevent uninitialized value exploitation even if logic errors occur. For system administrators unable to patch immediately, disabling hardware acceleration for TLS CBC ciphersuites or restricting incoming connections to only those using non-CBC modes like GCM may reduce exposure until the fix is deployed.