CVE-2026-49422

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory. The bug may be exploitable by an unprivileged local user to escalate privileges.

• CWE-416

• https://security.freebsd.org/advisories/FreeBSD-SA-26:43.tcp.ascVendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49417Second, the audio buffer backing a mapping could be freed wh…7
• CVE-2026-49418When msync(MS_INVALIDATE) is called on a mapping of an unman…8.8
• CVE-2026-49419When the JAIL_AT_DESC flag is specified, kern_jail_set() and…8.8
• CVE-2026-4942IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…7.5
• CVE-2026-49420The RTSP handler in libalias rewrote outgoing packets into a…8.8
• CVE-2026-49421The kernel function that implements unlinkat(2) and funlinka…7.1
• CVE-2026-49423When building the iovec array for a received TLS 1.2 CBC rec…3.3
• CVE-2026-49424The Linux waitid() implementation translates a FreeBSD sigin…5.5
• CVE-2026-49425The compat32 kevent() handler translates a 64-bit kevent str…5.5
• CVE-2026-49426When auditing a system call executed via ptrace(PT_SC_REMOTE…3.3
• CVE-2026-49427Pages belonging to largepage shared memory objects were not …8.8
• CVE-2026-49428Certain system calls, such open(2) with the O_TRUNC flag set…8.4