CVE-2026-101303
7.5HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-941
Impact
A process inside a jail can inject UDP datagrams into services bound to the host's IPv6 loopback interface. The attacker needs local execution inside a classic non-VNET jail.
Root cause
The IPv6 UDP send path for unconnected sockets failed to rewrite loopback destination addresses to the jail's assigned IPv6 address.
Affected systems
FreeBSD classic (non-VNET) jails; specific versions are not listed in the advisory summary, check FreeBSD-SA-26:69.udp.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade the host to the patched FreeBSD release referenced in advisory FreeBSD-SA-26:69.udp, or migrate affected containers to VNET jails to enforce virtualized network stack isolation.
$ freebsd-update fetch && freebsd-update installAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.