CVE-2026-49422

The FreeBSD advisory (FreeBSD-SA-26:43.tcp) confirms the bug affects all supported FreeBSD versions and provides specific correction commit hashes for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.4, and releng/14.3 branches, all dated 2026-06-30. Workarounds include not loading tcp_r...

CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...