The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.
The bug may be exploitable by an unprivileged local user to escalate privileges.
The bug may be exploitable by an unprivileged local user to escalate privileges.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 19 Aug 2026 05:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory. The bug may be exploitable by an unprivileged local user to escalate privileges. | |
| Title | Use-after-free in TCP RACK stack option handler | |
| Weaknesses | CWE-416 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: freebsd
Published:
Updated: 2026-08-19T05:28:32.468Z
Reserved: 2026-05-29T20:24:28.616Z
Link: CVE-2026-49422
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-19T06:17:41.447
Modified: 2026-08-19T06:17:41.447
Link: CVE-2026-49422
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-19T06:30:05Z
Weaknesses