CVE-2026-101305
8.8HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-273
Impact
A local attacker inside a FreeBSD jail can break out of the jail's root filesystem and access the host filesystem. They need local code execution inside the jail and access to a directory descriptor shared from outside or another jail on a reachable filesystem.
Root cause
The renameat(2) system call failed to enforce FD_RESOLVE_BENEATH on directory arguments, allowing a process to manipulate paths and escape using fchdir(2).
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the FreeBSD base system to the patched release specified in advisory FreeBSD-SA-26:66.jail.asc, or avoid passing host/external directory file descriptors into untrusted jails.
$ freebsd-update fetch && freebsd-update installAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.