CVE-2026-101306
Multiple jail filesystem root escapes
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in p4, p14, p1, p10
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Affected versions
- FreeBSD FreeBSD
From 15.1-RELEASE · fixed in p4; From 15.0-RELEASE · fixed in p14; From 14.5-RELEASE · fixed in p1; From 14.4-RELEASE · fixed in p10