Description
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Published: 2026-10-15
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Title Multiple jail filesystem root escapes
Weaknesses CWE-273
CWE-281
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: freebsd

Published:

Updated: 2026-10-15T06:46:25.804Z

Reserved: 2026-09-28T13:33:02.323Z

Link: CVE-2026-101306

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-15T07:17:57.780

Modified: 2026-10-15T07:17:57.780

Link: CVE-2026-101306

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-273

    Improper Check for Dropped Privileges

  • CWE-281

    Improper Preservation of Permissions