CVE-2026-3038 Details
Description
The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow. In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack frame, resulting in a panic once the function returns. The bug allows an unprivileged user to crash the kernel by triggering a stack buffer overflow in rtsock_msg_buffer(). In particular, the overflow will corrupt a stack canary value that is verified when the function returns; this mitigates the impact of the stack overflow by triggering a kernel panic. Other kernel bugs may exist which allow userspace to find the canary value and thus defeat the mitigation, at which point local privilege escalation may be possible.
A stack buffer overflow vulnerability has been identified in the FreeBSD routing socket interface, specifically within the rtsock_msg_buffer() function. This vulnerability affects all supported FreeBSD versions. The issue arises because the function copies sockaddr structures into a sockaddr_storage structure on the stack, assuming that the source sockaddr length field has been validated. However, a malicious userspace program can craft a request that triggers a 127-byte overflow. This overflow overwrites the stack canary, a security feature that helps detect buffer overflows, leading to a kernel panic when the function returns. While the immediate impact is a denial-of-service condition, other kernel vulnerabilities could potentially allow an unprivileged user to exploit this issue for local privilege escalation.
Users can upgrade to a supported FreeBSD stable or release branch dated after the correction date. Instructions for updating via the pkg utility, freebsd-update utility, or by applying a source code patch are available in the FreeBSD Security Advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:05.route.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 13.5 - 13.5 p1 13.5 p2 13.5 p3 13.5 p4 13.5 p5 13.5 p6 13.5 p7 13.5 p8 13.5 p9 14.3 - 14.3 p1 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 14.3 p7 14.3 p8 14.4 rc1 15.0 - 15.0 p1 15.0 p2 15.0 p3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 9, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | New CVE Received | [email protected] |