CVE-2026-49422 in FreeBSD
Summary
by MITRE • 08/19/2026
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.
The bug may be exploitable by an unprivileged local user to escalate privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
This vulnerability represents a classic race condition within the kernel's network stack implementation, specifically affecting the RACK (Retransmission Acknowledgment Cache) subsystem in Linux-based operating systems. The core technical flaw lies in the handling of connection locks during setsockopt operations. When processing socket options that involve copying data from userspace to kernelspace, the system temporarily releases the connection lock to prevent blocking other threads or processes while performing potentially slow memory copy operations. This is a standard concurrency control pattern intended to maintain system responsiveness and avoid deadlocks. However, in this specific implementation, after reacquiring the lock, the code performs a verification check to ensure that the TCP stack has not been switched away from its current state. While this check appears sufficient for single-context switches, it fails to account for scenarios where multiple context switches occur within the narrow window between releasing and re-acquiring the lock.
The critical failure occurs because the pointer to the per-connection control block is saved before the lock is released but not refreshed after reacquisition. If an unprivileged local user can trigger a sequence of events that causes the TCP stack to be switched away twice during this interval, the verification check will pass because it only validates against single switches or assumes stability based on outdated state information. Consequently, the kernel proceeds to use the saved pointer, which now references memory that has been freed and potentially reallocated for other purposes by different processes. This results in a Use-After-Free condition, where the kernel operates on stale data structures that no longer belong to the intended connection context.
From an industry standards perspective, this vulnerability aligns with CWE-416: Use After Free, which describes situations where software uses memory after it has been freed, leading to unpredictable behavior and potential security breaches. Furthermore, in the context of the MITRE ATT&CK framework, this flaw facilitates Privilege Escalation via Local Exploitation (T1068), as an attacker can leverage the corrupted control block pointers to manipulate kernel execution flow or memory contents. The ability to write arbitrary data through a dangling pointer allows for significant lateral movement within the system's privilege hierarchy, potentially leading to full root access if exploited correctly against sensitive kernel structures such as task_structs or credential objects.
The operational impact of this vulnerability is severe due to its potential for local privilege escalation without requiring prior authentication privileges beyond basic user access. An attacker can craft a malicious application that repeatedly invokes setsockopt with specific RACK-related options while simultaneously manipulating process scheduling and memory allocation patterns to trigger the race condition. Successful exploitation could allow an unprivileged user to execute arbitrary code in kernel space, bypassing all standard security controls including SELinux or AppArmor policies that rely on proper privilege boundaries. This compromises the integrity of the entire system, enabling data exfiltration, persistence mechanisms, and further attacks against other users or services running on the same host.
Mitigation strategies primarily involve applying vendor-provided kernel patches that address this specific race condition in the RACK implementation. These updates typically include reloading the pointer to the per-connection control block immediately after reacquiring the lock, ensuring that any changes made during the unlocked interval are reflected before proceeding with operations on the connection structure. Additionally, implementing stricter locking mechanisms or using reference counting for critical data structures can help prevent use-after-free scenarios by keeping memory alive until all references are released. System administrators should ensure their operating systems are updated to versions containing these fixes and monitor for any unusual local privilege escalation attempts through audit logging tools that track setsockopt calls and kernel panics related to network subsystems.