File Descriptor Escape Issue in FreeBSD Jail with fdescfs

CVE-2026-101304

What is CVE-2026-101304?

A vulnerability exists when fdescfs(4) is mounted in a jail with the 'nodup' option, allowing an opening on /dev/fd/N to create a file descriptor that lacks inherited rights and capabilities. This flaw enables a process in one jail to potentially escape the restrictions imposed by its jail's filesystem root, presenting a significant security risk as it could allow unauthorized access to the filesystem content of another jail or the host system itself.

References