← CVE Radar
CVE-2026-101304Multiple jail filesystem root escapes
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
7.1 HIGHEPSS 0.14%Not in KEVNVD: Modified
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.1 | HIGH | 3.1NVD | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-101304
- Status
- Modified
- Assigner (CNA)
- freebsd
- Published
- Oct 15, 2026
- Last modified
- 2026-10-20 17:17 UTC
- Weaknesses
- CWE-273 · Improper Check for Dropped Privileges
Affected Products
As published by the CNA in the CVE record.
FreeBSDFreeBSD4 version ranges
- 15.1-RELEASE before p4
- 15.0-RELEASE before p14
- 14.5-RELEASE before p1
- 14.4-RELEASE before p10