Directory Escape Vulnerability in FreeBSD Jails Affecting Process Isolation

CVE-2026-101305

What is CVE-2026-101305?

A vulnerability exists in FreeBSD jails where the renameat(2) function fails to enforce the FD_RESOLVE_BENEATH restriction on directory arguments. This flaw allows a jailed process to potentially rename a directory relative to a restricted descriptor, enabling it to escape its jailed environment via the fchdir(2) system call. This circumstance arises when the directory is located on a filesystem that remains accessible from the jail's root, leading to potential unauthorized access to the filesystem.

References