A flaw in FreeBSD’s implementation of TLS 1.3’s kTLS decryption allows an attacker to craft a record that causes the server to read past the buffer boundary. The resulting underflow triggers an unconditional NULL pointer dereference, which in turn produces a kernel panic. The denial of service is achieved without escalating privileges; the vulnerability is limited to remote clients that can initiate TLS connections.

The vulnerability affects FreeBSD kernel implementations that use the kTLS (kernel TLS) feature. Versions captured by this advisory are not listed by version, so any build that includes the unpatched kTLS code is susceptible.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is reported as less than 1 %, implying a very low but nonzero likelihood of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. Remote clients can exploit the flaw by sending a specially crafted TLS 1.3 record; the attack requires network access to a FreeBSD host that has kTLS enabled and does not need any privileged interaction.