CVEFinder.io

CVE-2026-49422

⚠️ high
🔍 Scan for this CVE
Summary

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory. The bug may be exploitable by an unprivileged local user to escalate privileges.

CVSS Score
8.4
High
EPSS Score
0.1
Exploit Probability
Published Date
2026-08-19
First Seen: 2026-08-20
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 79.9% of all 360,673 vulnerabilities in our database.

#72,538
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 19, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Maik Muench
SSVC data provided by CISA
Last Modified 2026-09-01
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)

📦 Affected Products 4

🔗 References 1

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-58095 ⚠️ high 8.8 0.6 mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a... 2026-08-26
CVE-2026-58096 ⚠️ high 8.8 0.6 LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by... 2026-08-26
CVE-2026-58097 ⚠️ high 7.8 0.2 mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ... 2026-08-26
CVE-2026-49415 ⚠️ high 8.8 0.2 During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated... 2026-08-19
CVE-2026-49418 ⚠️ high 8.8 0.3 When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range ... 2026-08-19
CVE-2026-49419 ⚠️ high 8.8 0.3 When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's curr... 2026-08-19
These CVEs affect the same products