CVE-2026-49422: Use-after-free in TCP RACK stack option handler
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.
The bug may be exploitable by an unprivileged local user to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue may be exploitable by an unprivileged local user. The described attack requires userspace to switch TCP stacks twice while the RACK setsockopt(2) handler has dropped the connection lock.
Is this remotely exploitable through ordinary network traffic?
The provided information describes a local userspace race involving setsockopt(2) and TCP stack switching. It does not state that remote network traffic alone can trigger the vulnerability.
What is the potential impact if exploitation succeeds?
The use-after-free may allow an unprivileged local user to escalate privileges.