CVE-2026-101306

Undergoing Analysis Undergoing Analysis - In Progress

SCM_RIGHTS File Descriptor Escape in FreeBSD Jail

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101306

EUVD

EUVD-2026-101867

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE
FreeBSD	FreeBSD	15.0-RELEASE
FreeBSD	FreeBSD	14.5-RELEASE
FreeBSD	FreeBSD	14.4-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-281	The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
CWE-273	The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in FreeBSD's jail system where file descriptors passed between processes do not maintain the FD_RESOLVE_BENEATH restriction. A process can exploit this by sending a file descriptor to itself over a Unix domain socket, effectively bypassing filesystem root restrictions in a jail environment.

Detection Guidance

Detection requires checking if your FreeBSD system is running a vulnerable version and if directory descriptors are being passed into jails. Review system logs for unusual activity in jailed processes. Use 'freebsd-version' to check your FreeBSD version and compare it against patched versions mentioned in the advisory.

Impact Analysis

If you use FreeBSD jails, a jailed process could escape its restricted filesystem view by exploiting this vulnerability. This could allow unauthorized access to files outside the jail, potentially compromising system security and data integrity.

Compliance Impact

This vulnerability allows jailed processes to escape filesystem restrictions, potentially granting unauthorized access to sensitive data. This could violate compliance requirements for data isolation and protection under standards like GDPR and HIPAA, which mandate strict access controls and data segregation.

Mitigation Strategies

Immediately upgrade your FreeBSD system using pkg, freebsd-update, or source patches as described in the advisory. Reboot the system after applying patches. Ensure no directory descriptors are passed into jails to reduce risk. Monitor for any signs of exploitation or unusual activity.

Hi! I’m here to help you understand CVE-2026-101306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70