CVE-2026-101304

Published: Oct 15, 2026Modified: Oct 20, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Affected (29)

Products: Freebsd: Freebsd

Freebsd

1 product

Freebsd

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 14.4
Freebsd Freebsd	Version 14.4 p1
Freebsd Freebsd	Version 14.4 p2
Freebsd Freebsd	Version 14.4 p3
Freebsd Freebsd	Version 14.4 p4
Freebsd Freebsd	Version 14.4 p5
Freebsd Freebsd	Version 14.4 p6
Freebsd Freebsd	Version 14.4 p7
Freebsd Freebsd	Version 14.4 p8
Freebsd Freebsd	Version 14.4 p9
Freebsd Freebsd	Version 14.5
Freebsd Freebsd	Version 15.0
Freebsd Freebsd	Version 15.0 p10
Freebsd Freebsd	Version 15.0 p11
Freebsd Freebsd	Version 15.0 p12
Freebsd Freebsd	Version 15.0 p13
Freebsd Freebsd	Version 15.0 p1
Freebsd Freebsd	Version 15.0 p2
Freebsd Freebsd	Version 15.0 p3
Freebsd Freebsd	Version 15.0 p4
Freebsd Freebsd	Version 15.0 p5
Freebsd Freebsd	Version 15.0 p6
Freebsd Freebsd	Version 15.0 p7
Freebsd Freebsd	Version 15.0 p8
Freebsd Freebsd	Version 15.0 p9
Freebsd Freebsd	Version 15.1
Freebsd Freebsd	Version 15.1 p1
Freebsd Freebsd	Version 15.1 p2
Freebsd Freebsd	Version 15.1 p3

Related CWEs

CWE-273

Improper Check for Dropped Privileges

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

References (1)

https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc

Source: secteam@freebsd.org

PatchVendor Advisory

Timeline

No history available yet.