CVE-2026-49422
Full vulnerability record from the local CVENow database.
Description
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory. The bug may be exploitable by an unprivileged local user to escalate privileges.
Severity
HIGH
CVSS score
8.4
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-19 06:17:41.447000
Last modified
2026-11-09 20:10:00.200000
View original CVE JSON
{
"id": "CVE-2026-49422",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T06:17:41.447",
"lastModified": "2026-11-09T20:10:00.200",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.\n\nThe bug may be exploitable by an unprivileged local user to escalate privileges."
},
{
"lang": "es",
"value": "El gestor RACK setsockopt(2) libera el bloqueo de conexión para copiar datos de opción desde el espacio de usuario, luego vuelve a adquirir el bloqueo. Después de volver a adquirirlo, verifica que la pila TCP no se había cambiado, pero no recargó su puntero al bloque de control por conexión de la pila. Si el espacio de usuario cambia de pila dos veces durante esta ventana, la verificación tendrá éxito pero el puntero guardado hará referencia a memoria liberada.\n\nEl error puede ser explotable por un usuario local no privilegiado para escalar privilegios."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "FreeBSD",
"product": "FreeBSD",
"defaultStatus": "unknown",
"modules": [
"tcp"
],
"versions": [
{
"version": "15.1-RELEASE",
"lessThan": "p1",
"versionType": "release",
"status": "affected"
},
{
"version": "15.0-RELEASE",
"lessThan": "p11",
"versionType": "release",
"status": "affected"
},
{
"version": "14.4-RELEASE",
"lessThan": "p7",
"versionType": "release",
"status": "affected"
},
{
"version": "14.3-RELEASE",
"lessThan": "p16",
"versionType": "release",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.5,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-19T00:00:00+00:00",
"id": "CVE-2026-49422",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*",
"matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*",
"matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*",
"matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*",
"matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:*",
"matchCriteriaId": "9F83F91B-587A-433C-99DB-0D63E267FF16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:*",
"matchCriteriaId": "44B9C2FC-756E-459F-8E68-C2C2B8C258AC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p14:*:*:*:*:*:*",
"matchCriteriaId": "A11526CF-505E-47DF-8388-65CB216D2022"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p15:*:*:*:*:*:*",
"matchCriteriaId": "632175D0-5327-4458-8968-8FA39D00F236"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*",
"matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*",
"matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*",
"matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*",
"matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*",
"matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*",
"matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*",
"matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*",
"matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*",
"matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "CBE94635-5277-4050-8098-F062091F6596"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "A66308E4-DA6E-48DB-86E5-A503EE110EAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*",
"matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
"matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*",
"matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*",
"matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*",
"matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*",
"matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*",
"matchCriteriaId": "BD327D43-A2DC-49B5-A578-D2116E1E12F3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "BF16D01F-95EC-4FE3-B32D-135CB82E8391"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:*",
"matchCriteriaId": "75973F7C-645A-438C-A03B-C77AAAD20C15"
}
]
}
]
}
],
"references": [
{
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:43.tcp.asc",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}