Unix Domain Socket Vulnerability in FreeBSD Jail Environments

CVE-2026-101306

What is CVE-2026-101306?

This vulnerability arises from a mismanagement of file descriptors during the passing of SCM_RIGHTS, failing to maintain the FD_RESOLVE_BENEATH restriction. This allows processes to effectively escape the filesystem root restrictions set by jails by manipulating directory file descriptors received from other jails. This loophole poses a significant threat to the integrity of segregated environments, potentially enabling unauthorized access to broader system resources.

References