When the TCP layer constructs a challenge acknowledgment it consumes the mbuf that is passed to it, but if no acknowledgment should be sent the function returns and the mbuf is left allocated. For each crafted packet that satisfies the challenge‑ACK criteria an mbuf leaks. With the default rate limit a host will leak one mbuf for every packet beyond the first five sent within one second, rapidly consuming kernel memory and eventually causing the system to halt or become unresponsive.

This weakness is present in the FreeBSD operating system. No particular release numbers are specified, so any FreeBSD version that contains the affected tcp_respond implementation may be vulnerable. Administrators should check the FreeBSD security advisory and apply the recommended update or newer release.

The flaw carries a CVSS base score of 7.5, indicating high severity. The EPSS probability is below 1 %, meaning exploitation is considered low‑probability unless an attacker has direct network access to a FreeBSD host. An attacker who can establish a TCP connection, or who is on the same path, can easily craft packets to trigger the leak. Off‑path attacks that rely on spoofing would be more complex and less likely to succeed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalogue, suggesting no confirmed wide‑scale attacks yet.