CVE-2026-101305 Overview
CVE-2026-101305 is a FreeBSD kernel vulnerability in the renameat(2) system call. The call fails to enforce the FD_RESOLVE_BENEATH restriction on its directory arguments. A process confined to a jail can use a directory file descriptor received from another jail to rename a directory outside its filesystem root. The attacker then uses fchdir(2) on the renamed directory to escape the jail. Exploitation requires the target directory to reside on a filesystem reachable from the jail root. FreeBSD classifies the weakness as [CWE-273] (improper check for dropped privileges).
Critical Impact
A jailed process holding a cross-jail directory descriptor can break out of its filesystem root and gain access to the host namespace, undermining jail-based isolation.
Affected Products
- FreeBSD 14.4 (base release through patch level p9)
- FreeBSD 14.5
- FreeBSD 15.0 (base release through patch level p13)
- FreeBSD 15.1 (base release through patch level p3)
Discovery Timeline
- 2026-10-15 - CVE-2026-101305 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-101305
Vulnerability Analysis
FreeBSD provides the FD_RESOLVE_BENEATH flag so that path lookups performed relative to a directory file descriptor cannot resolve components outside that descriptor. The jail subsystem relies on this behavior to keep lookups anchored inside the jail root. The renameat(2) implementation did not apply this restriction to its fromfd and tofd directory arguments. A caller inside a jail can therefore rename a directory to a path that resolves outside the jail's filesystem root. After renaming, the attacker calls fchdir(2) on the moved directory and inherits a working directory on the host namespace. Subsequent relative path operations are no longer bounded by the jail root, which gives read, write, and execute access to arbitrary files on any shared filesystem.
Root Cause
The root cause is a missing privilege check inside the renameat(2) lookup path. The syscall accepts directory descriptors but does not propagate the BENEATH resolution constraint that jails depend on. This is a confused-deputy pattern consistent with [CWE-273], where the kernel performs the operation with its own authority instead of validating that the caller's jail restrictions still apply.
Attack Vector
Exploitation requires an attacker to already execute code inside a jail and to possess a directory file descriptor originating from another jail or a less-restricted context. The attacker calls renameat(2) using that descriptor as the source directory and a controlled destination. The call succeeds because FD_RESOLVE_BENEATH is not enforced. The attacker then issues fchdir(2) on the relocated directory and traverses the resulting path to reach host files. The vulnerability is tracked in FreeBSD Security Advisory SA-26:66.
No public proof-of-concept code is available at this time. Refer to the vendor advisory for authoritative technical detail.
Detection Methods for CVE-2026-101305
Indicators of Compromise
- Unexpected renameat(2) calls originating from jailed processes that reference directory file descriptors inherited across jail boundaries.
- fchdir(2) activity by jailed processes immediately followed by access to paths outside the jail root.
- Appearance of new or renamed directories in filesystem locations that are mounted or shared between the jail and the host.
Detection Strategies
- Enable DTrace or audit(4) rules on renameat, openat, and fchdir syscalls, filtering for processes whose jid is non-zero.
- Correlate inode changes in shared filesystems against the originating process jid to identify cross-jail namespace manipulation.
- Review jail configuration for descriptors passed between jails via fdescfs, UNIX domain sockets, or process inheritance.
Monitoring Recommendations
- Forward audit(4) records to a centralized log store and alert on jailed processes writing outside expected mount points.
- Baseline per-jail syscall patterns and alert on anomalous renameat/fchdir sequences.
- Track installed kernel versions across FreeBSD hosts to confirm patch coverage against SA-26:66.
How to Mitigate CVE-2026-101305
Immediate Actions Required
- Apply the FreeBSD errata patch for SA-26:66 to all 14.4, 14.5, 15.0, and 15.1 systems and reboot into the patched kernel.
- Audit jail definitions and halt sharing of directory file descriptors between jails or between the host and jails until systems are patched.
- Inventory multi-tenant FreeBSD hosts running jails and prioritize those that expose services to untrusted users.
Patch Information
FreeBSD has released an updated kernel through FreeBSD Security Advisory SA-26:66. Administrators should install the vendor-supplied patch using freebsd-update fetch install on supported branches, then reboot. Source builds should rebuild and reinstall the kernel from the corresponding stable or releng branch.
Workarounds
- Avoid passing directory file descriptors into jails from the host or from other jails until the patch is deployed.
- Place each jail on a dedicated filesystem or dataset so that a successful rename cannot resolve to host-reachable paths.
- Restrict which users and services can execute code inside jails to limit the population of processes able to invoke renameat(2) with a cross-jail descriptor.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
