CVE-2026-49422
2026-08-19
05h28 +00:00
05h28 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
Use-after-free in TCP RACK stack option handler
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory. The bug may be exploitable by an unprivileged local user to escalate privileges.CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Use After Free The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
