CVE-2026-49422

Use-after-free in TCP RACK stack option handler

State: Published
Severity: 8.4 High
Published: Aug 19, 2026
Updated: Aug 20, 2026
Reserved: May 29, 2026

Description

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.

The bug may be exploitable by an unprivileged local user to escalate privileges.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
FreeBSDFreeBSD	15.1-RELEASE to before p1Affected 15.0-RELEASE to before p11Affected 14.4-RELEASE to before p7Affected 14.3-RELEASE to before p16Affected

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:43.tcp.ascvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.