FreeBSD up to 14.4-RC1/p3/p8/p9 rtsock_msg_buffer out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in FreeBSD up to 14.4-RC1/p3/p8/p9. Impacted is the function rtsock_msg_buffer. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2026-3038. The attack is possible to be carried out remotely. No exploit exists. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in FreeBSD up to 14.4-RC1/p3/p8/p9. It has been classified as critical. This affects the function rtsock_msg_buffer. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow. In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack frame, resulting in a panic once the function returns. The bug allows an unprivileged user to crash the kernel by triggering a stack buffer overflow in rtsock_msg_buffer(). In particular, the overflow will corrupt a stack canary value that is verified when the function returns; this mitigates the impact of the stack overflow by triggering a kernel panic. Other kernel bugs may exist which allow userspace to find the canary value and thus defeat the mitigation, at which point local privilege escalation may be possible.

The weakness was disclosed with Praetorian Labs Team. It is possible to read the advisory at security.freebsd.org. This vulnerability is uniquely identified as CVE-2026-3038 since 02/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/17/2026).

Applying a patch is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Name

• FreeBSD

Version

• 14.4-RC1
• p3
• p8
• p9

License

• open-source

Website

• Product: https://www.freebsd.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion