CVE-2026-49422 Use-after-free in TCP RACK stack option handler
An unprivileged local user can exploit a use-after-free in the TCP RACK stack to escalate privileges on FreeBSD systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49422?
CVE-2026-49422 is a high-severity use after free vulnerability in Freebsd Freebsd, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.
The bug may be exploitable by an unprivileged local user to escalate privileges.
Weakness: CWE-416
Which versions are affected by CVE-2026-49422?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2026-49422?
No fix has been published for CVE-2026-49422 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-49422 being exploited?
There is no known exploitation of CVE-2026-49422 in the wild and no public exploit code.