CVE-2026-49422
⚠️ highSummary
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory. The bug may be exploitable by an unprivileged local user to escalate privileges.
CVSS Score
8.4
High
EPSS Score
0.1
Exploit Probability
Published Date
2026-08-19
First Seen: 2026-08-20
📊 Relative Risk Intelligence
This CVE is High Risk - more severe than 79.9% of all 360,673 vulnerabilities in our database.
#72,538
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 19, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Maik Muench
SSVC data provided by
CISA
Last Modified
2026-09-01
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)