FreeBSD kTLS EUVD-2026-101870

The target must be a FreeBSD host (14.4-RELEASE before p10, 14.5-RELEASE before p1, 15.0-RELEASE before p14, or 15.1-RELEASE before p4) running kernel TLS (kTLS) with TLS 1.3 receive-side offload in use, and the attacker must be an established TLS 1.3 peer able to send a crafted/invalid record on that session. Exploitation is limited by the need for an active kTLS TLS 1.3 connection (PR:L - the attacker is a negotiated peer, not an arbitrary scanner) and by the feature being enabled; impact is confined to availability (kernel panic/DoS) with no code execution or data exposure.

All signals align toward a genuine but moderate-priority availability issue rather than a critical emergency. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium) describes a network-reachable, low-complexity flaw with no confidentiality or integrity impact and high availability impact - consistent with a NULL pointer dereference kernel panic. EPSS is low at 0.19% (8th percentile), SSVC reports Exploitation: none and Automatable: no with only partial Technical Impact, and the CVE is not in CISA KEV; no public exploit is identified. These corroborate a non-urgent, non-widespread threat. One nuance to verify: the vector sets PR:L, implying the attacker must already be an established TLS 1.3 peer rather than a wholly unauthenticated internet scanner - this is the key limiter and is consistent with the description's phrase 'a remote TLS 1.3 peer.' Overall this is a legitimate DoS to patch on exposed kTLS-enabled FreeBSD hosts, but it is not a high-real-risk, mass-exploitable condition.

An attacker who is a connected TLS 1.3 peer to a FreeBSD host using kernel TLS (kTLS) receive offload sends a specially crafted/invalid TLS record. The off-by-one in the inner-record-type search underflows and dereferences a NULL pointer, panicking the kernel and taking the entire host offline. No public exploit code is identified at time of analysis.