Vulnerability · Published Mar 9, 2026 · Assigned by freebsd

CVE-2025-15547Jail escape by a privileged user via nullfs

High 8.8

In plain English

A high-severity privilege mismanagement in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.1%top 97.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

By default, jailed processes cannot mount filesystems, including nullfs(4). However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic allows that user to escape the jail's chroot, yielding access to the full filesystem of the host or parent jail. In a jail configured to allow nullfs(4) mounts from within the jail, the jailed root user can escape the jail's filesystem root.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	14.3-RELEASE – before p813.5-RELEASE – before p9

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:02.jail.asc vendor-advisory