CVE-2026-49421
Received Received - Intake

unlinkat and funlinkat Path Traversal in FreeBSD Kernel

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: FreeBSD

Description
The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-49421
EUVD
EUVD-2026-62243

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freebsd freebsd From 14.0 (inc) to 15.999 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-273 The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects FreeBSD's unlinkat(2) and funlinkat(2) system calls. The AT_RESOLVE_BENEATH flag is meant to restrict path resolution to prevent accessing directories above a specified starting point. However, the kernel function validates the flag but fails to enforce it, effectively ignoring it during path lookup. This allows processes to resolve and delete files outside the intended directory tree.

Detection Guidance

To detect this vulnerability, check if your FreeBSD system is running an affected version by running: freebsd-version. If your system is on FreeBSD 14.x or 15.x and has not applied the patch, it is vulnerable. Review system logs for unusual file deletion activity or unauthorized path traversal attempts.

Impact Analysis

This vulnerability can allow an attacker or malicious process to delete files outside the intended directory tree, potentially causing data loss or system instability. Systems relying on AT_RESOLVE_BENEATH for path containment may be compromised, leading to unauthorized file operations.

Mitigation Strategies

Immediately update your FreeBSD system to a patched version using pkg update && pkg upgrade, freebsd-update fetch install, or apply source code patches. After updating, reboot the system to ensure the kernel changes take effect. No workaround exists other than patching and rebooting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart