CVE-2026-49422: RACK setsockopt Privilege Escalation Flaw

CVE-2026-49422 Overview

CVE-2026-49422 is a use-after-free vulnerability [CWE-416] in the FreeBSD kernel's RACK TCP stack setsockopt(2) handler. The handler drops the connection lock to copy option data from userspace, then reacquires it. After reacquiring the lock, the code verifies that the TCP stack has not been switched away, but it fails to reload its pointer to the stack's per-connection control block. An unprivileged local user who switches TCP stacks twice during this window can pass the verification check while the saved pointer references freed memory. The bug may be exploitable to escalate privileges on affected FreeBSD systems.

Critical Impact
Local unprivileged users can trigger a kernel use-after-free in the RACK TCP stack, potentially leading to privilege escalation on FreeBSD systems.

Affected Products

FreeBSD operating system with the RACK TCP stack available
Refer to the FreeBSD Security Advisory for the authoritative list of affected releases
Systems allowing unprivileged use of TCP_FUNCTION_BLK stack switching

Discovery Timeline

2026-08-19 - CVE-2026-49422 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-49422

Vulnerability Analysis

The FreeBSD kernel supports pluggable TCP stacks, allowing socket owners to switch a connection between implementations such as the default stack and the RACK (Recent ACKnowledgment) stack. Each stack maintains a per-connection control block accessed through a pointer stored on the socket.

The RACK setsockopt(2) handler must copy option data from userspace, an operation that can sleep. To avoid blocking with the connection lock held, the handler releases the lock, performs the copy, then reacquires the lock. Upon reacquisition, the handler checks whether the TCP stack has changed and aborts if so. However, it does not reload the local pointer to the RACK control block after reacquiring the lock.

An attacker with local access can race the handler by switching the socket to a different TCP stack and back to RACK while the lock is dropped. The identity check succeeds because RACK is once again the active stack, yet the original control block has been freed and reallocated during the intermediate switch. Subsequent writes through the stale pointer corrupt freed kernel memory.

Root Cause

The root cause is a stale cached pointer combined with an incomplete revalidation after lock reacquisition. The handler validates one piece of state (the stack identity) but not the object whose lifetime is tied to that state (the control block).

Attack Vector

Exploitation requires local access. An unprivileged process opens a TCP socket, sets the TCP stack to RACK, issues a RACK-specific setsockopt(2) call, and races two TCP_FUNCTION_BLK stack switches during the userspace copy window. See the FreeBSD Security Advisory for the technical description.

Detection Methods for CVE-2026-49422

Indicators of Compromise

Unprivileged processes repeatedly calling setsockopt(2) with TCP_FUNCTION_BLK to switch TCP stacks in rapid succession
Kernel panics or page faults originating in RACK TCP stack functions
Unexpected dmesg entries referencing use-after-free conditions or corrupted TCP control blocks

Detection Strategies

Enable kernel diagnostic facilities such as MALLOC_DEBUG and INVARIANTS on non-production hosts to surface freed-memory writes
Audit setsockopt(2) telemetry for non-root processes that toggle TCP function blocks at high frequency
Correlate kernel crash reports with process ancestry to identify unprivileged callers preceding the fault

Monitoring Recommendations

Collect FreeBSD dtrace probes on tcp_switch_back_to_default and RACK stack entry points
Forward kernel logs and crash dumps to a central SIEM for retention and anomaly review
Alert on repeated TCP stack transitions from a single PID within short time windows

How to Mitigate CVE-2026-49422

Immediate Actions Required

Apply the FreeBSD security patch referenced in FreeBSD-SA-26:43.tcp as soon as it is available for your release
Restrict local shell access on multi-user FreeBSD hosts and audit accounts with interactive login rights
Inventory systems that load the RACK TCP stack module and prioritize patching those first

Patch Information

FreeBSD has issued Security Advisory FreeBSD-SA-26:43.tcp addressing the flaw. Administrators should install the corresponding errata patch or upgrade to a fixed release, then reboot to load the corrected kernel. Consult the advisory for exact commit identifiers and supported release branches.

Workarounds

Unload the RACK TCP stack kernel module where it is not required, using kldunload tcp_rack
Prevent automatic loading by removing tcp_rack_load="YES" from /boot/loader.conf
Restrict use of alternate TCP stacks by setting the net.inet.tcp.functions_default sysctl to freebsd and limiting local user access

bash

# Verify RACK is not loaded and default TCP stack is in use
kldstat | grep tcp_rack
sysctl net.inet.tcp.functions_available
sysctl net.inet.tcp.functions_default=freebsd
kldunload tcp_rack