Severity: Unknown
Affected Package: kernel/ktls
Summary: Remote denial of service via receive-side kernel TLS (CVE-2026-101302)
Kernel TLS (KTLS) moves Transport Layer Security record processing into the kernel, allowing applications to encrypt and decrypt socket data without copying it to and from userspace and to serve TLS data with sendfile(2). When a connection uses software KTLS on the receive path, the kernel decrypts each incoming TLS record in place within the socket buffer. TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. tls13_find_record_type() in sys/kern/uipc_ktls.c, which searches backwards for that byte, recorded an offset one past it and compensated when computing the trailer length. For a record whose plaintext is entirely zero-filled, the search returned the offset of the last byte of the TLS header instead of failing, the trailer length computation underflowed, and the subsequent decryption dereferenced a NULL pointer. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a denial of service. Only sockets on which an application has enabled receive-side KTLS are affected. Systems with the kern.ipc.tls.enable sysctl set to 0 are unaffected.
No specific recommendations provided.
Aliases: CVE-2026-101302
Published: October 01, 2026
Last Modified: October 01, 2026