CVE-2026-101306
9.8CriticalPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-273, CWE-281
Impact
A process inside a jail can escape its filesystem root restriction to access the host filesystem. The attacker needs an existing execution context in a jail and a directory descriptor passed from another jail or the host.
Root cause
Unix domain socket SCM_RIGHTS descriptor passing fails to retain the FD_RESOLVE_BENEATH flag, allowing a process to clear the restriction by sending the file descriptor to itself.
Affected systems
FreeBSD (exact versions not listed in advisory summary — check vendor advisory FreeBSD-SA-26:66.jail.asc).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the patch or updated kernel specified in FreeBSD-SA-26:66.jail.asc and reboot. As an interim mitigation, avoid sharing directory file descriptors across jail boundaries or passing them via Unix domain sockets to untrusted jail processes.
$ freebsd-update fetch installAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.