CVE-2026-49422

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description A use-after-free issue exists in the tcp rack.ko kernel module. The RACK setsockopt(2) handler releases the connection lock to copy option data from userspace and subsequently reacquires it. While the handler verifies that the TCP stack was not switched, it fails to reload the pointer to the stack's per-connection control block. If userspace triggers stack switches twice during this interval, the verification succeeds, but the saved pointer references memory that has already been freed. An unprivileged local user could exploit this to escalate privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.