CVE-2026-49419

Analyzed Analyzed - Analysis Complete

Double Free in FreeBSD Jail System

Publication date: 2026-08-19

Last updated on: 2026-09-01

Assigner: FreeBSD

Description

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-09-01

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-49419

EUVD

EUVD-2026-62231

Affected Vendors & Products

Vendor	Product	Version / Range
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.0
freebsd	freebsd	15.1
freebsd	freebsd	15.0
freebsd	freebsd	15.1
freebsd	freebsd	15.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-911	The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.

Attack-Flow Graph

Executive Summary

CVE-2026-49419 is a jail reference count underflow vulnerability in FreeBSD affecting versions 15.0 and later. When the JAIL_AT_DESC flag is used, kern_jail_set() and kern_jail_get() release the reference to the caller's current prison before looking up the jail descriptor. If the lookup fails, error handling releases the same reference again, causing an underflow. This can free the prison structure while it is still in use.

An unprivileged local user can trigger this bug to cause a system panic on the jail host or potentially escalate privileges if already inside a jail.

Detection Guidance

Detecting this vulnerability requires checking the FreeBSD version and installed patches. Run 'freebsd-version' or 'uname -r' to verify the system version. Compare against patched versions (stable/15, releng/15.1, releng/15.0). Check for applied updates via 'pkg audit' or 'freebsd-update fetch && freebsd-update install'.

Impact Analysis

This vulnerability allows an unprivileged local user to crash the system with a panic if they are on the jail host. If they are inside a jail, they may be able to escalate their privileges beyond the jail's restrictions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to FreeBSD jail mechanisms and local privilege escalation. However, if exploited, it could lead to unauthorized access or system instability, potentially violating data integrity or availability requirements in regulated environments.

Mitigation Strategies

Upgrade FreeBSD to a patched version (stable/15, releng/15.1, or releng/15.0) using pkg upgrade, freebsd-update, or a source code patch. After updating, reboot the system immediately to apply changes.

Hi! I’m here to help you understand CVE-2026-49419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70