Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-101305

Multiple jail filesystem root escapes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.1-RELEASE to < p4affected
  • 15.0-RELEASE to < p14affected
  • 14.5-RELEASE to < p1affected
  • 14.4-RELEASE to < p10affected

References