Local Privilege Escalation Vulnerability in FreeBSD Jail Management

CVE-2026-49419

What is CVE-2026-49419?

A local privilege escalation vulnerability exists in FreeBSD's jail management system due to improper handling of prison references when the JAIL_AT_DESC flag is used. Specifically, the functions kern_jail_set() and kern_jail_get() release the reference to the caller's current prison prior to attempting to locate the jail descriptor. If the lookup fails, the error-handling processes can erroneously release the same reference a second time. This flaw allows an unprivileged local user to trigger a prison reference count underflow, potentially leading to the premature deallocation of the prison structure while still in use. This issue can cause immediate system panic if exploited on the jail host, but for users operating within a jail, it may provide an opportunity to elevate their privileges.

References