{"id":"CVE-2026-101306","published":"2026-10-15T07:17:57.780","lastModified":"2026-10-16T19:17:00.147","description":"SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-273","CWE-281"],"vendors":[],"products":[],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A flaw in SCM_RIGHTS file descriptor passing allows processes to escape jail filesystem restrictions by clearing the FD_RESOLVE_BENEATH flag when transferring descriptors between processes. This enables jailed processes to access files outside their designated root directory.","exploitability":"Exploitation requires a process within a jail to receive a directory file descriptor from another jail and then send it to itself over a Unix domain socket, which is moderately difficult but achievable with proper setup.","blast_radius":"The impact could be severe across all systems using jailed environments where processes can receive and transfer directory descriptors, potentially allowing full system compromise by escaping the jail boundaries.","remediation":"Upgrade to 2.590 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["jail-escape","file-descriptor","unix-domain-socket"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:45:51.519Z"}}