CVE-2026-49421

FreeBSD's unlinkat/funlinkat syscalls validated the AT_RESOLVE_BENEATH flag but silently dropped it during path lookup, allowing processes to delete files outside the intended directory tree. All supported FreeBSD branches are affected; patches were committed on 2026-06-30. No workaround exists; ...

CVE-2026-49421 unlinkat(2) ignores AT_RESOLVE_BENEATH flag

The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses ATRESOLVEBENEATH with unlinkat2 or...