CVE-2026-101306
Analyzed Analyzed - Analysis Complete

SCM_RIGHTS File Descriptor Escape in FreeBSD Jail

Publication date: 2026-10-15

Last updated on: 2026-10-20

Assigner: FreeBSD

Description
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-20
Generated
2026-11-08
AI Q&A
2026-10-15
EPSS Evaluated
2026-11-07
NVD
CVE-2026-101306
EUVD
EUVD-2026-101867

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-281 The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
CWE-273 The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in FreeBSD's jail system where file descriptors passed between processes do not maintain the FD_RESOLVE_BENEATH restriction. A process can exploit this by sending a file descriptor to itself over a Unix domain socket, effectively bypassing filesystem root restrictions in a jail environment.

Detection Guidance

Detection requires checking if your FreeBSD system is running a vulnerable version and if directory descriptors are being passed into jails. Review system logs for unusual activity in jailed processes. Use 'freebsd-version' to check your FreeBSD version and compare it against patched versions mentioned in the advisory.

Impact Analysis

If you use FreeBSD jails, a jailed process could escape its restricted filesystem view by exploiting this vulnerability. This could allow unauthorized access to files outside the jail, potentially compromising system security and data integrity.

Compliance Impact

This vulnerability allows jailed processes to escape filesystem restrictions, potentially granting unauthorized access to sensitive data. This could violate compliance requirements for data isolation and protection under standards like GDPR and HIPAA, which mandate strict access controls and data segregation.

Mitigation Strategies

Immediately upgrade your FreeBSD system using pkg, freebsd-update, or source patches as described in the advisory. Reboot the system after applying patches. Ensure no directory descriptors are passed into jails to reduce risk. Monitor for any signs of exploitation or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...