Local Privilege Escalation Vulnerability in FreeBSD Jail Management
CVE-2026-49419

8.8HIGH

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
19 August 2026

What is CVE-2026-49419?

A local privilege escalation vulnerability exists in FreeBSD's jail management system due to improper handling of prison references when the JAIL_AT_DESC flag is used. Specifically, the functions kern_jail_set() and kern_jail_get() release the reference to the caller's current prison prior to attempting to locate the jail descriptor. If the lookup fails, the error-handling processes can erroneously release the same reference a second time. This flaw allows an unprivileged local user to trigger a prison reference count underflow, potentially leading to the premature deallocation of the prison structure while still in use. This issue can cause immediate system panic if exploited on the jail host, but for users operating within a jail, it may provide an opportunity to elevate their privileges.

Affected Version(s)

FreeBSD 15.1-RELEASE

FreeBSD 15.0-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:38....
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
.