Loading vulnerability…
CVE-2026-3038 is a stack-based buffer overflow in the FreeBSD kernel routing socket subsystem, specifically in rtsock_msg_buffer() in sys/net/rtsock.c. The function serializes routing information into an output buffer and copies user-influenced sockaddr data into a fixed-size struct sockaddr_storage allocated on the kernel stack. The vulnerable code assumes the source sockaddr length field (sa_len) has already been validated, but that assumption is incorrect for at least one reachable path. A malicious local userspace process can craft an RTM_GET routing socket request with attacker-controlled sockaddr content, including an oversized sa_len value up to 255, causing up to 127 bytes of attacker-controlled data to overflow the 128-byte sockaddr_storage stack buffer. Reported analysis indicates RTAX_AUTHOR can bypass earlier validation, and RTM_GET is exempt from the PRIV_NET_ROUTE privilege check, making the bug reachable by an unprivileged local user. On typical production kernels, the overflow corrupts the stack canary in the rtsock_msg_buffer() frame and is detected when the function returns, leading to a panic.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
pkg upgrade -r FreeBSD-base followed by reboot; using freebsd-update fetch and freebsd-update install followed by reboot for supported RELEASE systems; or applying the vendor patch from https://security.FreeBSD.org/patches/SA-26:05/route.patch, verifying its signature, then rebuilding and rebooting.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stack-based buffer overflow in the FreeBSD routing socket subsystem that allows an unprivileged attacker in a VNET jail to overflow a kernel stack buffer via RTM_GET using a user-controlled sa_len field, and was used as part of a jail-escape exploit chain.
A stack-based buffer overflow in the FreeBSD RTSock subsystem that allows an unprivileged local user to trigger a 127-byte kernel stack overflow via crafted routing socket messages; described as a reliable local denial of service by default and potentially useful for privilege escalation with an additional canary leak.
A FreeBSD routing sockets vulnerability that can cause local denial of service and may enable privilege escalation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.