CVE-2026-101305

Undergoing Analysis Undergoing Analysis - In Progress

Jail filesystem escape via renameat(2) misuse

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101305

EUVD

EUVD-2026-101866

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE
FreeBSD	FreeBSD	15.0-RELEASE
FreeBSD	FreeBSD	14.5-RELEASE
FreeBSD	FreeBSD	14.4-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-273	The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

Attack-Flow Graph

Executive Summary

This vulnerability involves FreeBSD's jail system, which restricts processes to a limited filesystem view. The renameat(2) system call did not properly enforce the FD_RESOLVE_BENEATH restriction on directory arguments. A jailed process could exploit this to rename a directory relative to a restricted descriptor and escape the jail root using fchdir(2). This requires the directory to be on a filesystem accessible from the jail's root.

Detection Guidance

Detecting this vulnerability requires checking if your FreeBSD system is running a vulnerable version and if directory descriptors are being passed into jails. Review the jail configuration and file descriptor handling in fdescfs. No specific commands are provided in the advisory for detection beyond verifying system versions and configurations.

Impact Analysis

If you use FreeBSD jails, a malicious process inside a jail could escape its restricted filesystem view. This could allow unauthorized access to files outside the jail, potentially compromising system security. Exploitation requires the attacker to receive a directory file descriptor from another jail.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements like GDPR or HIPAA that mandate strict data isolation and access controls. A jail escape could expose sensitive data, resulting in regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Immediately upgrade your FreeBSD system using pkg, freebsd-update, or source patches to apply the fixes for CVE-2026-101305. Reboot the system after applying patches. Ensure that directory descriptors are not passed into jails, as systems not doing so are not at risk.

Hi! I’m here to help you understand CVE-2026-101305. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70