CVE-2026-101303: FreeBSD IPv6 UDP Auth Bypass Vulnerability

CVE-2026-101303 Overview

CVE-2026-101303 is a jail isolation bypass in the FreeBSD kernel's IPv6 UDP send path for unconnected sockets. The kernel fails to apply the jail policy that rewrites a loopback destination address to the jail's primary IPv6 address. As a result, a process confined to a classic (non-VNET) jail can transmit UDP datagrams to services listening on the host's IPv6 loopback (::1) address. This breaks the network isolation boundary that administrators rely on when running untrusted workloads inside jails. The flaw is tracked under [CWE-941: Incorrectly Specified Destination in a Communication Channel] and is addressed in FreeBSD Security Advisory 26:69.

Critical Impact
A jailed process can reach host-only IPv6 UDP services, breaking a core jail security boundary and exposing loopback-bound daemons to attack from inside containers.

Affected Products

FreeBSD 14.4 (base release and patch levels p1 through p9)
FreeBSD 14.5
FreeBSD 15.0 (base release and patch levels p1 through p13)
FreeBSD 15.1 (base release and patch levels p1 through p3)

Discovery Timeline

2026-10-15 - CVE-2026-101303 published to the National Vulnerability Database (NVD)
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-101303

Vulnerability Analysis

FreeBSD jails provide lightweight operating-system-level virtualization. A classic (non-VNET) jail shares the host's network stack but is restricted to a defined set of IP addresses. The kernel enforces this restriction by rewriting outbound packets so a jailed process cannot reference arbitrary addresses, including the loopback interface, which must map to the jail's assigned primary address.

For IPv6 UDP traffic sent on unconnected sockets, this rewrite step is skipped. A process inside a classic jail can therefore target ::1 directly. Any UDP service bound to the host loopback address becomes reachable from within the jail, even though the operator expected those services to be unreachable from containerized workloads.

Successful exploitation does not disclose data to the attacker, but it allows a confined process to send arbitrary UDP payloads to host-only services. Depending on which daemons listen on IPv6 loopback, this can be used to tamper with management interfaces, inject configuration or metrics data, or trigger unintended control-plane actions.

Root Cause

The root cause is a missing jail policy check in the IPv6 UDP output path for unconnected sockets. The equivalent IPv4 and connected-socket paths perform the loopback-to-primary-address rewrite, but the IPv6 unconnected-send branch does not. The omission causes the stack to accept ::1 as a valid destination from inside a classic jail and deliver the datagram to the host loopback.

Attack Vector

Exploitation requires code execution inside a classic (non-VNET) jail on an affected FreeBSD version. The attacker opens an IPv6 UDP socket without calling connect(), then uses sendto() with ::1 and the port of a target host service. The kernel delivers the datagram to the host loopback rather than rejecting it or rewriting the destination. VNET jails, which maintain a fully virtualized network stack, are not affected because they do not share the host loopback. Full technical details are available in the FreeBSD Security Advisory 26:69.

Detection Methods for CVE-2026-101303

Indicators of Compromise

UDP datagrams observed on the host IPv6 loopback (::1) with source credentials belonging to a jailed process ID.
Unexpected inbound traffic to host-only UDP services (for example, management or metrics daemons bound to ::1) originating from workloads that should be network-isolated.
Audit records showing sendto() calls to ::1 from processes whose jid is non-zero.

Detection Strategies

Enable FreeBSD audit (auditd) with socket and network event classes to log sendto() targets and correlate them with the originating jail ID.
Instrument the host with DTrace probes on the IPv6 UDP output path to flag datagrams produced by jailed processes with a loopback destination.
Compare running kernel version (freebsd-version -k) against the patched versions listed in FreeBSD-SA-26:69 and alert on any jail host still running an affected build.

Monitoring Recommendations

Baseline which UDP services legitimately bind to ::1 on each jail host and alert on connections from unexpected source PIDs or jail IDs.
Forward FreeBSD audit and syslog data to a centralized analytics platform to correlate jail process activity with host-level socket events.
Track vendor advisories from security.freebsd.org for errata releases and update detections accordingly.

How to Mitigate CVE-2026-101303

Immediate Actions Required

Apply the kernel updates described in FreeBSD-SA-26:69 to all affected 14.4, 14.5, 15.0, and 15.1 hosts that run classic jails.
Reboot updated systems so the patched kernel is loaded; the fix lives in the network stack and requires a kernel-level restart.
Audit services bound to ::1 on jail hosts and confirm none are reachable from inside existing jails after patching.

Patch Information

FreeBSD has released fixed kernels through FreeBSD Security Advisory 26:69. Administrators should install the vendor-supplied patch using freebsd-update on supported binary releases, or rebuild from the patched source branch. After updating, restart the host to activate the corrected IPv6 UDP output path.

Workarounds

Migrate workloads from classic jails to VNET jails, which maintain a separate network stack and are not affected by this flaw.
Bind sensitive UDP services to specific non-loopback interfaces, or require authentication on services currently reachable only via ::1.
Use host firewall rules (pf or ipfw) to drop IPv6 UDP traffic to ::1 that originates from jail credentials where feasible.

bash

# Verify kernel version against FreeBSD-SA-26:69
freebsd-version -k

# Apply vendor patches and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now

# Example pf rule to block IPv6 UDP from jail ranges to loopback
block in quick on lo0 inet6 proto udp from <jail_addrs> to ::1