renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
References
| Link | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Oct 2026, 00:20
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.5:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p13:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p9:*:*:*:*:*:* |
|
| References | () https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc - Patch, Vendor Advisory | |
| First Time |
Freebsd freebsd
Freebsd |
16 Oct 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
15 Oct 2026, 07:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-15 07:17
Updated : 2026-10-20 00:20
NVD link : CVE-2026-101305
Mitre link : CVE-2026-101305
CVE.ORG link : CVE-2026-101305
JSON object : View
Products Affected
freebsd
- freebsd
CWE
CWE-273
Improper Check for Dropped Privileges