CVE-2026-3038

The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow. In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack frame, resulting in a panic once the function returns. The bug allows an unprivileged user to crash the kernel by triggering a stack buffer overflow in rtsock_msg_buffer(). In particular, the overflow will corrupt a stack canary value that is verified when the function returns; this mitigates the impact of the stack overflow by triggering a kernel panic. Other kernel bugs may exist which allow userspace to find the canary value and thus defeat the mitigation, at which point local privilege escalation may be possible.

• CWE-787

• https://security.freebsd.org/advisories/FreeBSD-SA-26:05.route.ascVendor Advisory

Published

Mar 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30351A path traversal vulnerability in the UI/static component of…7.5
• CVE-2026-30352A remote code execution (RCE) vulnerability in the /devserve…9.8
• CVE-2026-30363flipperzero-firmware commit ad2a80 was discovered to contain…8.4
• CVE-2026-30364CentSDR commit e40795 was discovered to contain a stack over…7.5
• CVE-2026-30368A client-side authorization flaw in Lightspeed Classroom v5.…5.4
• CVE-2026-3037An OS command injection vulnerability exists in XWEB Pro ver…8.8
• CVE-2026-3039BIND servers that are configured to use TKEY-based authentic…7.5
• CVE-2026-3040A vulnerability was identified in DrayTek Vigor 300B up to 1…7.2
• CVE-2026-30402An issue in wgcloud v.2.3.7 and before allows a remote attac…9.8
• CVE-2026-30403There is an arbitrary file read vulnerability in the test co…7.5
• CVE-2026-30404The backend database management connection test feature in w…7.5
• CVE-2026-30405An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to…7.5