FreeBSD: Jail filesystem root escape through renameat(2)
Summary
FreeBSD jails confine processes to a restricted view of the filesystem. Because renameat(2) did not enforce FD_RESOLVE_BENEATH on directory arguments, a process inside a jail that holds a directory file descriptor passed from another jail can rename a directory and then escape the jail root via fchdir(2). The directory must reside on a filesystem that is also reachable from the jail root. An attacker therefore needs code execution inside a jail, so the issue mainly affects shared hosts that run untrusted jails.
Affected
- FreeBSD 15.1-RELEASE before 15.1-RELEASE-p4
- FreeBSD 15.0-RELEASE before 15.0-RELEASE-p14
- FreeBSD 14.5-RELEASE before 14.5-RELEASE-p1
- FreeBSD 14.4-RELEASE before 14.4-RELEASE-p10
- The advisory states that all supported versions are affected. Default configuration: unknown.
Fixed in
- 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10 or later
- Stable and releng branches corrected on 2026-09-29 or later. Reboot the system after updating.
Workaround
- No workaround is available.
- Systems that do not pass directory file descriptors into jails are not affected.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact total.
- No public proof of concept found. No evidence of exploitation in the wild. Not listed in CISA KEV.
Our recommendation
- Update affected hosts to a fixed release or to a stable or releng branch dated after 2026-09-29, then reboot.
- Prioritise shared jail hosts that run untrusted code.
- Until patched, avoid passing directory file descriptors between jails.
- Check whether any FreeBSD-based appliances in use have received the fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- FreeBSD-SA-26:66.jail Security Advisory security.freebsd.org
- VulDB CVE-2026-101305 vuldb.com
- Vulners CVE-2026-101305 vulners.com
- Strix CVE-2026-101305 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:36.
Original description (NVD)
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.