-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-26:43.tcp                                        Security Advisory
                                                          The FreeBSD Project

Topic:          Use-after-free in TCP RACK stack option handler

Category:       core
Module:         tcp
Announced:      2026-06-30
Credits:        Maik Muench
Affects:        All supported versions of FreeBSD.
Corrected:      2026-06-30 17:20:11 UTC (stable/15, 15.1-STABLE)
                2026-06-30 17:22:00 UTC (releng/15.1, 15.1-RELEASE-p1)
                2026-06-30 17:21:28 UTC (releng/15.0, 15.0-RELEASE-p11)
                2026-06-30 17:19:52 UTC (stable/14, 14.4-STABLE)
                2026-06-30 17:21:00 UTC (releng/14.4, 14.4-RELEASE-p7)
                2026-06-30 17:20:34 UTC (releng/14.3, 14.3-RELEASE-p16)
CVE Name:       CVE-2026-49422

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

FreeBSD supports multiple pluggable TCP stacks.  A given TCP socket can
be configured to use a particular TCP implementation via setsockopt(2).

The RACK stack implements the Recent ACKnowledgment (RACK) loss
detection algorithm and is provided as the loadable kernel module
tcp_rack.ko.

II.  Problem Description

The RACK setsockopt(2) handler drops the connection lock in order to
copy option data from userspace, then reacquires the lock.  After
reacquiring, it verifies that the TCP stack had not been switched away,
but did not reload its pointer to the stack's per-connection control
block.  If userspace switches stacks twice during this window, the
check will succeed but the saved pointer will refer to freed memory.

III. Impact

The bug may be exploitable by an unprivileged local user to escalate
privileges.

IV.  Workaround

Systems that have not loaded the tcp_rack.ko kernel module are not
affected.  The module is not loaded by default.  To check whether
it is loaded, run:

# kldstat -m tcp_rack

V.   Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date, and
reboot the system.

Perform one of the following:

1) To update your vulnerable system installed from base system packages:

Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:

# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"

2) To update your vulnerable system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-26:43/tcp.patch
# fetch https://security.FreeBSD.org/patches/SA-26:43/tcp.patch.asc
# gpg --verify tcp.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/15/                              aed4c4dd9afc    stable/15-n284327
releng/15.1/                            490e506a1ca8  releng/15.1-n283572
releng/15.0/                            57b3853cc9bb  releng/15.0-n281074
stable/14/                              df8885512da5    stable/14-n274452
releng/14.4/                            800acf75eb80  releng/14.4-n273734
releng/14.3/                            8845978fec03  releng/14.3-n271534
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://www.cve.org/CVERecord?id=CVE-2026-49422>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:43.tcp.asc>
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmpEEkcbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv+1AQAMZB1D+dHqyjfENkZer9
nXE18ljPEZzAO/wZvEls9PbqqAX9eyYK7dChKsQchYiRNQVDekXc9BEgOpFJuJPH
ZbjNpH+xnzt7iMTiU2lQnOqASrtfVsvwWoLOvqeTIKr2O0Sh9v2SfyurQS8zEh6D
JdgVQKrGT6Nw0wQ/Kc/Ul4Wii2gkGP9kIcqhDRNfqMybuxAYJEYlWqKwzLlI36j+
C7f3d5CNhhXdjuv08Rvyp6Pvh5hd04yQGiI1iN4pCqJlGLOvguPm0DJhr1WOqOcI
jjkPL5envbvOFhEDe69scIsfZnvcXv79IgYyZvz2rKnO/k3Ce7azEUWjMQemb1ZD
ih6FDn1HtOb04zTMFCtdZAd05+qr2B9BsynGcFBdg/KGG1is87VU0SpyYSv5Uj7z
tbFfxb8mPvulMqmG+l29voVBRJB5VqSr3zCBMEc/GrvI0R+d7sHWSSgB898s7XPE
H/QzpHwDmvE0k7sIDQeevjhvj93XrkS6+QOcNiJRmc9G7+UOBssxOzp20GAKD9a1
/h2fzCpyjS3hJxQ9Y9xUeSiibS2tneZ7d4hoTZm9+5JIq3Y1ORdL0gOFHFdDIfFU
nLKNPguFAGZkd/ASS6/ULvW7UqZJ0UdQrcFS5RIBMsYNYF8uCDramlZ4qWiz2DsT
yqCs7JnSKZzpSqdKKEQSKabq
=oO9/
-----END PGP SIGNATURE-----