The bug occurs in the TCP RACK options handler when it drops the connection lock before copying data from userspace and later reacquires the lock. The handler verifies that the TCP stack has not changed but fails to reload the pointer to the stack’s control block. If a local user switches stacks twice during this window, the check succeeds while the saved pointer refers to freed memory, creating a use‑after‑free that may let the attacker execute code in the kernel, thereby escalating privileges from a non‑privileged account to root.

The vulnerability affects FreeBSD systems running the default TCP stack that implements the RACK algorithm. No specific version information is provided; all current releases that contain the unpatched RACK logic are potentially impacted.

The flaw is exploitable from a local, unprivileged context and can lead to full system compromise. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the lack of a public exploit does not reduce its severity. The CVSS score is not supplied in the data, but the nature of the use‑after‑free in kernel code implies a high severity with a low likelihood of remote exploitation compared to the high impact of local privilege escalation.