CVE-2026-101303

Undergoing Analysis Undergoing Analysis - In Progress

UDP IPv6 Loopback Address Rewrite Bypass in FreeBSD Jail

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101303

EUVD

EUVD-2026-101874

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE
FreeBSD	FreeBSD	15.0-RELEASE
FreeBSD	FreeBSD	14.5-RELEASE
FreeBSD	FreeBSD	14.4-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-941	The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects FreeBSD systems using IPv6 UDP send operations in classic (non-VNET) jails. The IPv6 UDP send path for unconnected sockets fails to enforce jail network isolation policies. Processes in these jails can send UDP datagrams to services on the host's IPv6 loopback address, bypassing intended network restrictions.

Detection Guidance

To detect this vulnerability, check if your FreeBSD system is running an unpatched version of IPv6 UDP sendto(2) operations. Verify the system version against the patched releases dated September 28-29, 2026. Use commands like 'freebsd-version' or 'uname -a' to check the version. If using jails, inspect classic (non-VNET) jails for processes sending UDP datagrams to IPv6 loopback addresses.

Impact Analysis

This vulnerability allows processes in a classic jail to communicate with services on the host's IPv6 loopback address, potentially bypassing network isolation. This could lead to unauthorized access to host services or data, depending on the services exposed on the loopback address.

Compliance Impact

This vulnerability allows processes in classic jails to bypass network isolation by sending UDP datagrams to IPv6 loopback services on the host. This could potentially violate data protection requirements under GDPR or HIPAA by enabling unauthorized network communication from isolated environments.

Mitigation Strategies

Upgrade affected FreeBSD systems immediately using pkg(8), freebsd-update(8), or source code patches. Reboot the system after applying updates. If using classic jails, consider migrating to VNET jails or ensure no IPv6 loopback communication occurs. No workaround exists for affected systems.

Hi! I’m here to help you understand CVE-2026-101303. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70