CVE-2026-49423
Last modified
CVE-2026-49423 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. EPSS estimates a 0.10% chance of exploitation in the next 30 days.
Description
When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was allocated without zeroing. A remote TLS peer can cause the kernel to read from uninitialized iovec entries during HMAC computation, resulting in a kernel panic. The peer must be able to control TCP segmentation such that the first mbuf of a CBC record contains only the 5-byte TLS record header.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Freebsd | Freebsd | 14.3 |
| Freebsd | Freebsd | 14.4 |
| Freebsd | Freebsd | 15.0 |
| Freebsd | Freebsd | 15.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-49423?
How severe is CVE-2026-49423?
How do I fix CVE-2026-49423?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-49418When msync(MS_INVALIDATE) is called on a mapping of an unman…8.8
- CVE-2026-49419When the JAIL_AT_DESC flag is specified, kern_jail_set() and…8.8
- CVE-2026-4942IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…7.5
- CVE-2026-49420The RTSP handler in libalias rewrote outgoing packets into a…8.8
- CVE-2026-49421The kernel function that implements unlinkat(2) and funlinka…7.1
- CVE-2026-49422The RACK setsockopt(2) handler drops the connection lock in …8.4
- CVE-2026-49424The Linux waitid() implementation translates a FreeBSD sigin…5.5
- CVE-2026-49425The compat32 kevent() handler translates a 64-bit kevent str…5.5
- CVE-2026-49426When auditing a system call executed via ptrace(PT_SC_REMOTE…3.3
- CVE-2026-49427Pages belonging to largepage shared memory objects were not …8.8
- CVE-2026-49428Certain system calls, such open(2) with the O_TRUNC flag set…8.4
- CVE-2026-49429The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), …7.8
Are you affected by CVE-2026-49423?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST