CVE-2026-3038

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3038", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2026-02-23T16:26:02.807Z", "datePublished": "2026-03-09T12:25:39.671Z", "dateUpdated": "2026-03-09T16:03:25.820Z"}, "containers": {"cna": {"datePublic": "2026-02-24T17:00:00.000Z", "title": "Local DoS and possible privilege escalation via routing sockets", "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:05.route.asc"}], "affected": [{"defaultStatus": "unknown", "modules": ["route"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "versionType": "release", "version": "15.0-RELEASE", "lessThan": "p4"}, {"status": "affected", "versionType": "release", "version": "14.3-RELEASE", "lessThan": "p9"}, {"status": "affected", "versionType": "release", "version": "13.5-RELEASE", "lessThan": "p10"}, {"status": "affected", "versionType": "beta", "version": "14.4-RC1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Adam Crosser of the Praetorian Labs team"}], "descriptions": [{"lang": "en", "value": "The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow.\n\n In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack frame, resulting in a panic once the function returns.\n\nThe bug allows an unprivileged user to crash the kernel by triggering a stack buffer overflow in rtsock_msg_buffer(). In particular, the overflow will corrupt a stack canary value that is verified when the function returns; this mitigates the impact of the stack overflow by triggering a kernel panic.\n\nOther kernel bugs may exist which allow userspace to find the canary value and thus defeat the mitigation, at which point local privilege escalation may be possible."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-03-09T12:25:39.671Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T16:03:08.637542Z", "id": "CVE-2026-3038", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T16:03:25.820Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-3038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T16:03:08.637542Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T16:03:18.320Z"}}], "cna": {"title": "Local DoS and possible privilege escalation via routing sockets", "credits": [{"lang": "en", "type": "finder", "value": "Adam Crosser of the Praetorian Labs team"}], "affected": [{"vendor": "FreeBSD", "modules": ["route"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.0-RELEASE", "lessThan": "p4", "versionType": "release"}, {"status": "affected", "version": "14.3-RELEASE", "lessThan": "p9", "versionType": "release"}, {"status": "affected", "version": "13.5-RELEASE", "lessThan": "p10", "versionType": "release"}, {"status": "affected", "version": "14.4-RC1", "versionType": "beta"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-24T17:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:05.route.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow.\n\n In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack frame, resulting in a panic once the function returns.\n\nThe bug allows an unprivileged user to crash the kernel by triggering a stack buffer overflow in rtsock_msg_buffer(). In particular, the overflow will corrupt a stack canary value that is verified when the function returns; this mitigates the impact of the stack overflow by triggering a kernel panic.\n\nOther kernel bugs may exist which allow userspace to find the canary value and thus defeat the mitigation, at which point local privilege escalation may be possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2026-03-09T12:25:39.671Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3038", "state": "PUBLISHED", "dateUpdated": "2026-03-09T16:03:25.820Z", "dateReserved": "2026-02-23T16:26:02.807Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2026-03-09T12:25:39.671Z", "assignerShortName": "freebsd"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["route"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p4", "status": "affected", "version": "15.0-RELEASE", "versionType": "release"}, {"lessThan": "p9", "status": "affected", "version": "14.3-RELEASE", "versionType": "release"}, {"lessThan": "p10", "status": "affected", "version": "13.5-RELEASE", "versionType": "release"}, {"status": "affected", "version": "14.4-RC1", "versionType": "beta"}]}], "source": "secteam@freebsd.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*", "matchCriteriaId": "947F561E-AD65-43B9-94C1-3109A3D35248", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*", "matchCriteriaId": "3D1987F1-1E08-4B28-8D16-D25A091D99ED", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*", "matchCriteriaId": "BEC1E8A0-0402-45F1-938D-FEFDCFC3E747", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*", "matchCriteriaId": "D94457D6-738F-4ABB-BD46-F2B621531FE2", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*", "matchCriteriaId": "8C38CB56-B80C-4D1B-9267-16E8F985B170", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*", "matchCriteriaId": "13DF1E38-5E8D-42FF-A4C5-092300864F3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*", "matchCriteriaId": "83A86F81-0965-4600-835A-496756137998", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*", "matchCriteriaId": "987E31A4-7E21-471E-A3EA-4E53FFDB3DFB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*", "matchCriteriaId": "9FBFE8B3-DC7C-4394-B062-C40E201EC059", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*", "matchCriteriaId": "563C1D65-625D-43FC-A7A0-75B1E2163C40", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*", "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*", "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*", "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*", "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*", "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*", "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*", "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*", "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*", "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*", "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*", "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*", "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*", "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow.\n\n In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack frame, resulting in a panic once the function returns.\n\nThe bug allows an unprivileged user to crash the kernel by triggering a stack buffer overflow in rtsock_msg_buffer(). In particular, the overflow will corrupt a stack canary value that is verified when the function returns; this mitigates the impact of the stack overflow by triggering a kernel panic.\n\nOther kernel bugs may exist which allow userspace to find the canary value and thus defeat the mitigation, at which point local privilege escalation may be possible."}, {"lang": "es", "value": "La funci\u00f3n rtsock_msg_buffer() serializa informaci\u00f3n de enrutamiento en un b\u00fafer. Como parte de esto, copia estructuras sockaddr en una estructura sockaddr_storage en la pila. Asume que el campo de longitud de la sockaddr de origen ya hab\u00eda sido validado, pero este no es necesariamente el caso, y es posible que un programa malicioso en el espacio de usuario elabore una solicitud que desencadene un desbordamiento de 127 bytes.\n\nEn la pr\u00e1ctica, este desbordamiento sobrescribe inmediatamente el canario del marco de pila de rtsock_msg_buffer(), lo que resulta en un p\u00e1nico una vez que la funci\u00f3n regresa.\n\nEl error permite a un usuario sin privilegios bloquear el kernel al desencadenar un desbordamiento de b\u00fafer de pila en rtsock_msg_buffer(). En particular, el desbordamiento corromper\u00e1 un valor de canario de pila que se verifica cuando la funci\u00f3n regresa; esto mitiga el impacto del desbordamiento de pila al desencadenar un p\u00e1nico del kernel.\n\nOtros errores del kernel pueden existir que permitan al espacio de usuario encontrar el valor del canario y as\u00ed anular la mitigaci\u00f3n, momento en el que la escalada de privilegios local puede ser posible."}], "id": "CVE-2026-3038", "lastModified": "2026-06-17T10:42:55.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3038", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T16:03:08.637542Z", "version": "2.0.3"}}]}, "published": "2026-03-09T13:15:57.227", "references": [{"source": "secteam@freebsd.org", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:05.route.asc"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "secteam@freebsd.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.0-RELEASE,p4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[14.3-RELEASE,p9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[13.5-RELEASE,p10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14.4-RC1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeBSD", "source": "cna", "vendor": "FreeBSD"}, "product": "freebsd", "vendor": "freebsd"}], "analysis": {"en": {"generated_at": "2026-04-16T10:14:42.508465+00:00", "value": {"mitigation_remediation": ["Update the FreeBSD system to a patch release that includes the fix for CVE-2026-3038 (e.g., 13.5-p9, 14.3-p8, or 15.0-p3 or newer).", "If an immediate update is not feasible, restrict unprivileged access to routing sockets by disabling the routing socket interface in system configuration, for example by setting net.inet.routed to 0 or applying appropriate ACLs if supported. ", "Enable and configure a watchdog or kernel panic monitoring service so that any unintended kernel panics caused by misbehaving processes are detected and the system can recover automatically."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "FreeBSD releases affected include 13.5 (patches 1 through 9), 14.3 (patches 1 through 8), 14.4 rc1, and 15.0 (patches 1 through 3). All these versions are impacted until the advisory\u2019s fix is applied.", "description_and_impact": "A buffer overflow in the FreeBSD routing socket handler rtsock_msg_buffer copies unchecked sockaddr data onto the stack, overwriting a stack canary and causing a kernel panic when the function returns. The crash can be induced by any unprivileged user that can send a crafted routing socket request, resulting in a local denial of service. If a separate kernel flaw later exposes the canary value, the overflow could also be weaponized for local privilege escalation.", "risk_and_exploitability": "The CVSS score of 7.5 marks the flaw as high severity, yet the EPSS score of <1% indicates an extremely low likelihood of exploitation in the wild. The vulnerability is local; an attacker must be able to run arbitrary code on the target system to send the malicious routing socket message. The flaw is not listed in CISA\u2019s KEV catalog, reinforcing the perception that it is not actively exploited at present."}}}}, "created": "2026-03-10T14:07:24.282639+00:00", "updated": "2026-04-16T10:15:26.116334+00:00", "vendors": ["freebsd", "freebsd$PRODUCT$freebsd"]}