Vulnerability · Published Oct 15, 2026 · Assigned by freebsd

CVE-2026-101306Multiple jail filesystem root escapes

Critical 9.8

In plain English

A critical-severity security flaw in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	15.1-RELEASE – before p415.0-RELEASE – before p1414.5-RELEASE – before p114.4-RELEASE – before p10

Weakness: CWE-273, CWE-281 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc vendor-advisory