CVE-2026-101306

9.8 Critique

Publiée le 15/10/2026 à 09:17 · Modifiée le 20/10/2026 à 02:21 · Analysée par le NVD · Source : secteam@freebsd.org

Description

SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Traduire en français

Produits concernés

FreeBSD
Freebsd freebsd

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-273
CWE-281

Références

https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc PatchVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories