IPv6 UDP Vulnerability in FreeBSD Jail Network Isolation
CVE-2026-101303

Currently unrated

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
15 October 2026

What is CVE-2026-101303?

An oversight in the IPv6 UDP handling for unconnected sockets within FreeBSD jail environments permits processes in a classic jail to send UDP datagrams to services that are bound to the host's IPv6 loopback address. This effectively allows these processes to circumvent the intended network isolation restrictions set by the jail, exposing systems to potential external interactions through the host’s loopback interface.

Affected Version(s)

FreeBSD 15.1-RELEASE

FreeBSD 15.0-RELEASE

FreeBSD 14.5-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:69....
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
.