Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-101304

Multiple jail filesystem root escapes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.1-RELEASE to < p4affected
  • 15.0-RELEASE to < p14affected
  • 14.5-RELEASE to < p1affected
  • 14.4-RELEASE to < p10affected

References