CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

FreeBSD-SA-26:43.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:43.tcp Security Advisory The FreeBSD Project Topic: Use-after-free in TCP RACK stack option handler Category: core Module: tcp Announced: 2026-06-30 Credits:...

PT-2026-55923

Name of the Vulnerable Software and Affected Versions FreeBSD OpenZFS affected versions not specified Description A kernel heap overflow exists in the zfs ioc userspace many function within the ZFS IOC USERSPACE MANY ioctl used by zfs-userspace8. The issue occurs because a 64-bit output buffer si...