This vulnerability stems from uninitialized memory entries in the iovec array constructed during a KTLS receive operation for TLS 1.2 CBC records. When a malicious TLS peer crafts a record that causes the first mbuf to contain only the 5‑byte TLS header, the decoding routine reads from these uninitialized entries while computing the record HMAC, resulting in a kernel panic. The crash is deterministic and causes a full system reboot, providing a crude but effective denial of service.

The flaw is located in the FreeBSD operating system’s kernel TLS offload (KTLS) receive path. All FreeBSD releases that contain the vulnerable KTLS implementation are affected; the advisory does not list specific version ranges.

The attack is remote and requires only the ability to establish a TLS session with the vulnerable host. Based on the description, it is inferred that no authentication or elevated privileges are needed. EPSS scoring shows an exploitation likelihood of less than 1 %. The CVSS score of 3.3 indicates a low severity. The vulnerability is not included in CISA’s KEV catalog. Successful exploitation results in a kernel panic and immediate loss of all services on the affected machine.