CVE-2026-101306

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...

CVE-2026-101305

renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...

CVE-2026-101306 Multiple jail filesystem root escapes

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...

CVE-2026-101306

FreeBSD is vulnerable to a jail filesystem root escape due to SCM_RIGHTS file descriptor passing failing to preserve the FD_RESOLVE_BENEATH flag. A process within a jail can bypass filesystem restrictions by receiving a directory file descriptor from another jail and sending it to itself over a U...

EUVD-2026-101867

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...

CVE-2026-101306

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...

CVE-2026-101305

renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...

CVE-2026-101305 Multiple jail filesystem root escapes

renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...

EUVD-2026-101866

renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...

CVE-2026-101304 Multiple jail filesystem root escapes

When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...

CVE-2026-101304

When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...

CVE-2026-101305: Improper Check for Dropped Privileges

renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...

CVE-2026-101306: Improper Check for Dropped Privileges

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...

FreeBSD : FreeBSD -- Multiple jail filesystem root escapes (1fe3495b-bccd-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1fe3495b-bccd-11f1-906f-bc241121aa0a advisory. Three flaws allow a jailed process to bypass FDRESOLVEBENEATH: A process in a jail that has...