CVE-2026-101305
Full vulnerability record from the local CVENow database.
Description
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-10-15 07:17:57.663000
Last modified
2026-10-20 00:20:16.620000
View original CVE JSON
{
"id": "CVE-2026-101305",
"sourceIdentifier": "[email protected]",
"published": "2026-10-15T07:17:57.663",
"lastModified": "2026-10-20T00:20:16.620",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "FreeBSD",
"product": "FreeBSD",
"defaultStatus": "unknown",
"modules": [
"jail"
],
"versions": [
{
"version": "15.1-RELEASE",
"lessThan": "p4",
"versionType": "release",
"status": "affected"
},
{
"version": "15.0-RELEASE",
"lessThan": "p14",
"versionType": "release",
"status": "affected"
},
{
"version": "14.5-RELEASE",
"lessThan": "p1",
"versionType": "release",
"status": "affected"
},
{
"version": "14.4-RELEASE",
"lessThan": "p10",
"versionType": "release",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T18:30:17.230798Z",
"id": "CVE-2026-101305",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-273"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*",
"matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "CBE94635-5277-4050-8098-F062091F6596"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "A66308E4-DA6E-48DB-86E5-A503EE110EAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:*",
"matchCriteriaId": "59EF67B4-E572-483B-BC9E-B2D3D8DF19CE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p8:*:*:*:*:*:*",
"matchCriteriaId": "B47E6FB0-4176-449D-9955-09A236E9F5BC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p9:*:*:*:*:*:*",
"matchCriteriaId": "5E8C9CFB-32F9-4BCB-A030-84F9261BA357"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:14.5:-:*:*:*:*:*:*",
"matchCriteriaId": "1A6A046C-21F7-468C-A106-A3358FD20F8D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*",
"matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:*",
"matchCriteriaId": "9EC8EE3F-9992-4A0F-A0CD-3B44BA086BD2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:*",
"matchCriteriaId": "CC1797AB-83A6-4379-865F-8AD495EACEEC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p13:*:*:*:*:*:*",
"matchCriteriaId": "5AA78C5B-D4CC-4E03-B42F-0F1DCABACE91"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
"matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*",
"matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*",
"matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*",
"matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*",
"matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*",
"matchCriteriaId": "BD327D43-A2DC-49B5-A578-D2116E1E12F3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:*",
"matchCriteriaId": "E379873C-DA04-4EAA-ABF6-EB87B4B471A8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:*",
"matchCriteriaId": "044A3D39-A2AF-499C-8434-0A07B5854661"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:freebsd:freebsd:15.1:p3:*:*:*:*:*:*",
"matchCriteriaId": "C75C73C4-ED12-44D9-85EF-A0388D9ECFA2"
}
]
}
]
}
],
"references": [
{
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}