Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-101306

Multiple jail filesystem root escapes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.1-RELEASE to < p4affected
  • 15.0-RELEASE to < p14affected
  • 14.5-RELEASE to < p1affected
  • 14.4-RELEASE to < p10affected

References