CVE-2026-101306 Multiple jail filesystem root escapes

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...

CVE-2026-101306

FreeBSD is vulnerable to a jail filesystem root escape due to SCM_RIGHTS file descriptor passing failing to preserve the FD_RESOLVE_BENEATH flag. A process within a jail can bypass filesystem restrictions by receiving a directory file descriptor from another jail and sending it to itself over a U...

CVE-2026-101306 Multiple jail filesystem root escapes

SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...

CVE-2026-101305 Multiple jail filesystem root escapes

renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...

CVE-2026-101305

The FreeBSD operating system is affected by a vulnerability where the renameat(2) system call fails to enforce the FD_RESOLVE_BENEATH flag on directory arguments. This flaw allows a process within a jail to escape the jail's filesystem root restriction by renaming a directory relative to a restri...

CVE-2026-101304 Multiple jail filesystem root escapes

When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...

CVE-2026-101304

The FreeBSD operating system is vulnerable to a multiple jail filesystem root escape due to three flaws in how file descriptors are handled. Specifically, when fdescfs(4) is mounted in a jail with the "nodup" option, opening /dev/fd/N returns a descriptor that fails to inherit FD_RESOLVE_BENEATH ...

CVE-2026-101304 Multiple jail filesystem root escapes

When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...