CVE-2026-101306
Received
Received - Intake
SCM_RIGHTS File Descriptor Escape in FreeBSD Jail
Vulnerability report for CVE-2026-101306, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-15
Last updated on: 2026-10-15
Assigner: FreeBSD
Description
Description
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| FreeBSD | FreeBSD | 15.1-RELEASE |
| FreeBSD | FreeBSD | 15.0-RELEASE |
| FreeBSD | FreeBSD | 14.5-RELEASE |
| FreeBSD | FreeBSD | 14.4-RELEASE |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-281 | The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended. |
| CWE-273 | The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. |
