CVE-2026-101304: FreeBSD Privilege Escalation Vulnerability

CVE-2026-101304 Overview

CVE-2026-101304 is a FreeBSD jail escape vulnerability affecting the fdescfs(4) file descriptor filesystem. When fdescfs is mounted inside a jail with the nodup option, opening /dev/fd/N returns a descriptor that fails to inherit the FD_RESOLVE_BENEATH flag or the Capsicum capability rights of descriptor N. A process inside a jail that has received a directory file descriptor from another jail can abuse this flaw to break out of its filesystem root restriction. The issue is tracked under CWE-273: Improper Check for Dropped Privileges and affects multiple FreeBSD 14.x and 15.x releases.

Critical Impact
A confined jailed process can escape the jail's filesystem root and access host or neighboring jail files, breaking a core FreeBSD isolation boundary.

Affected Products

FreeBSD 14.4 (including patch levels p1 through p9)
FreeBSD 14.5
FreeBSD 15.0 (including patch levels p1 through p13) and 15.1 (including p1 through p3)
Systems using fdescfs(4) mounted inside a jail with the nodup option

Discovery Timeline

2026-10-15 - CVE-2026-101304 published to the National Vulnerability Database
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-101304

Vulnerability Analysis

FreeBSD's fdescfs(4) exposes a process's open file descriptors as entries under /dev/fd/. The nodup mount option changes semantics so that opening /dev/fd/N returns a new descriptor referring to the same underlying file, rather than duplicating descriptor N. In the vulnerable code path, this new descriptor is created without copying two critical access-restriction properties attached to the original descriptor.

The missing properties are the FD_RESOLVE_BENEATH flag, which forces path resolution to stay beneath a specified directory, and the Capsicum capability rights set, which constrains the operations permitted on the descriptor. Jails rely on these mechanisms to confine directory file descriptors shared across trust boundaries.

Root Cause

The root cause is improper preservation of privilege-restricting metadata when creating a derived file descriptor. The fdescfsnodup open path produces a descriptor that is effectively more privileged than its source, violating the principle that derived handles must not exceed the authority of their origin. This aligns with CWE-273, improper handling of dropped privileges during descriptor duplication.

Attack Vector

Exploitation is local and requires low privileges inside a jail. An attacker inside a jail must obtain a directory file descriptor originating from another jail or the host. If fdescfs is mounted with nodup inside the attacker's jail, the attacker opens /dev/fd/N to retrieve a sibling descriptor that lacks FD_RESOLVE_BENEATH and lacks the restrictive Capsicum rights. The attacker can then use path lookups relative to that descriptor to traverse outside the jail's filesystem root, accessing files on the host or in other jails. No user interaction is required.

See the FreeBSD Security Advisory SA-26:66 for the authoritative technical description.

Detection Methods for CVE-2026-101304

Indicators of Compromise

Unexpected fdescfs mounts inside jails with the nodup option present in /etc/fstab or jail configuration files
Jailed processes performing openat(2) calls against /dev/fd/N followed by path lookups that resolve outside the jail root
Access attempts from jailed UIDs against host filesystem paths in audit logs

Detection Strategies

Audit all jail configurations for fdescfs entries that include the nodup mount option and flag them for review
Enable FreeBSD auditd(8) with policies that record openat and path-resolution events originating from jailed processes
Correlate file descriptor passing over UNIX domain sockets between jails or between the host and jails

Monitoring Recommendations

Collect auditd logs centrally and alert on jailed process access to paths outside the jail's chroot
Monitor mount tables on jail hosts for drift from the approved baseline configuration
Track FreeBSD base system patch levels across the fleet to confirm all hosts receive the SA-26:66 fix

How to Mitigate CVE-2026-101304

Immediate Actions Required

Apply the FreeBSD base system patches described in FreeBSD-SA-26:66.jail to all affected 14.4, 14.5, 15.0, and 15.1 systems
Review every jail configuration for fdescfs mounts using the nodup option and remove the option where it is not strictly required
Audit workflows that pass directory file descriptors between jails or from the host into jails and restrict them where possible

Patch Information

FreeBSD has released source and binary updates addressing CVE-2026-101304. Administrators should follow the update procedure in FreeBSD-SA-26:66.jail.asc, which includes applying the base system patch, rebuilding the kernel if source updates are used, and restarting affected jails. Confirm patched systems by checking the running patch level with freebsd-version -k and uname -a after reboot.

Workarounds

Unmount fdescfs inside jails where it is not required, or remount it without the nodup option until patches are applied
Avoid passing directory file descriptors between jails or between the host and jails on unpatched systems
Restrict jail creation and configuration privileges to trusted administrators to prevent unauthorized fdescfs mounts

bash

# Review current fdescfs mounts for the vulnerable nodup option
mount | grep fdescfs

# Remount fdescfs inside a jail without the nodup option
umount /path/to/jail/dev/fd
mount -t fdescfs none /path/to/jail/dev/fd

# Confirm patch level after applying FreeBSD-SA-26:66
freebsd-version -k