{"cve":"CVE-2026-49422","nvd":{"published":"2026-08-19T06:17:41.447","modified":"2026-09-01T20:20:00.687","status":"Analyzed","description":"The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock.  After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block.  If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.\n\nThe bug may be exploitable by an unprivileged local user to escalate privileges.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4},"cwes":["CWE-416"],"references":["https://security.freebsd.org/advisories/FreeBSD-SA-26:43.tcp.asc"],"products":["freebsd:freebsd"],"source":"nvd","synced_at":"2026-10-19T22:49:38.260478770+00:00"},"epss":{"cve":"CVE-2026-49422","score":0.00168,"percentile":0.05998,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}