CVE-2026-49419

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.asc	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:freebsd:freebsd:15.0:-::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p1::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p10::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p2::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p3::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p4::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p5::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p6::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p7::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p8::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p9::::::
	cpe:2.3:o:freebsd:freebsd:15.1:-::::::
	cpe:2.3:o:freebsd:freebsd:15.1:rc2::::::
	cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1::::::

History

No history.

Information

Published : 2026-08-19 05:17

Updated : 2026-09-01 20:20

NVD link : CVE-2026-49419

Mitre link : CVE-2026-49419

CVE.ORG link : CVE-2026-49419

JSON object : View

Products Affected

freebsd

freebsd

CWE

CWE-911

Improper Update of Reference Count

{"id": "CVE-2026-49419", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49419", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T03:56:04.011376Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secteam@freebsd.org", "affectedData": [{"vendor": "FreeBSD", "modules": ["jail"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.1-RELEASE", "lessThan": "p1", "versionType": "release"}, {"status": "affected", "version": "15.0-RELEASE", "lessThan": "p11", "versionType": "release"}], "defaultStatus": "unknown"}]}], "published": "2026-08-19T05:17:04.053", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.asc", "tags": ["Vendor Advisory"], "source": "secteam@freebsd.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secteam@freebsd.org", "description": [{"lang": "en", "value": "CWE-911"}]}], "descriptions": [{"lang": "en", "value": "When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time.\n\nAn unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges."}], "lastModified": "2026-09-01T20:20:18.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD327D43-A2DC-49B5-A578-D2116E1E12F3"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF16D01F-95EC-4FE3-B32D-135CB82E8391"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75973F7C-645A-438C-A03B-C77AAAD20C15"}], "operator": "OR"}]}], "sourceIdentifier": "secteam@freebsd.org"}