CVE-2026-101306: FreeBSD Privilege Escalation Vulnerability

CVE-2026-101306 Overview

CVE-2026-101306 is a FreeBSD kernel vulnerability in the handling of SCM_RIGHTS file descriptor passing over Unix domain sockets. The kernel fails to preserve the FD_RESOLVE_BENEATH restriction when a descriptor is transferred between processes. A process can clear the restriction by sending the descriptor to itself through a AF_UNIX socket. In a jailed environment, a process that receives a directory descriptor from another jail can leverage this to escape its filesystem root restriction. The flaw affects FreeBSD 14.4, 14.5, 15.0, and 15.1 release branches. It is tracked under [CWE-273: Improper Check for Dropped Privileges].

Critical Impact
Jailed processes can escape the filesystem root restriction and access host or other-jail filesystem contents, breaking a core FreeBSD isolation boundary.

Affected Products

FreeBSD 14.4 (including patch levels p1 through p9)
FreeBSD 14.5 and FreeBSD 15.0 (including patch levels p1 through p13)
FreeBSD 15.1 (including patch levels p1 through p3)

Discovery Timeline

2026-10-15 - CVE-2026-101306 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-101306

Vulnerability Analysis

FreeBSD exposes the O_RESOLVE_BENEATH and AT_RESOLVE_BENEATH flags, which translate into the per-descriptor FD_RESOLVE_BENEATH restriction. This flag constrains path resolution so that symlinks and .. components cannot traverse above the directory the descriptor refers to. Jails and Capsicum-style sandboxing rely on this guarantee to confine filesystem access.

The kernel's SCM_RIGHTS code path, which duplicates file descriptors into a receiving process via Unix domain sockets, does not propagate the FD_RESOLVE_BENEATH per-fd flag onto the newly installed descriptor. Once stripped, the descriptor can resolve paths that escape the originally restricted subtree, and in jailed contexts, escape the chroot-style filesystem root.

Root Cause

The root cause is an incomplete privilege-preservation check during descriptor transfer. When control messages carrying descriptors are received, the kernel re-installs the file into the receiving process's descriptor table without copying the FD_RESOLVE_BENEATH restriction bit from the sender's table entry. The security property is attached to the descriptor table slot rather than to the underlying struct file, so the restriction is silently dropped on transfer.

Attack Vector

A process holding a FD_RESOLVE_BENEATH-restricted directory descriptor opens a Unix domain socket pair, sends the descriptor to itself using sendmsg with an SCM_RIGHTS control message, and reads it back with recvmsg. The returned descriptor references the same directory but without the beneath restriction, and can then be used with openat, fchdir, or *at syscalls to resolve .. outside the intended subtree. In a jail scenario, a cooperating or compromised process in one jail passes a directory descriptor to a process in another jail, which then clears the restriction and traverses to the host filesystem root.

No verified proof-of-concept code is published. See the FreeBSD Security Advisory SA-26:66 for the vendor's technical description.

Detection Methods for CVE-2026-101306

Indicators of Compromise

Jailed processes issuing sendmsg/recvmsg calls with SCM_RIGHTS control messages targeting their own process or peers in other jails.
Jailed processes opening or resolving paths outside the jail's configured path directory, visible in audit(4) records for openat, fchdir, and *at syscalls.
Unexpected directory descriptors shared between distinct jails via unix(4) sockets bound in shared filesystem locations.

Detection Strategies

Enable FreeBSD audit(4) with the fc, fw, and fm classes to capture file descriptor and path operations originating from jailed jid > 0 processes.
Alert on openat or fchdir operations from jailed processes resolving paths whose canonicalized form falls outside the jail root recorded in jls -v.
Correlate SCM_RIGHTS descriptor transfers between processes with different jid values; cross-jail descriptor passing is rare in normal workloads.

Monitoring Recommendations

Forward auditd logs and jail syscall telemetry to a central analytics platform for retrospective hunting against the techniques described in FreeBSD SA-26:66.
Baseline normal SCM_RIGHTS usage per jailed service and alert on new sender/receiver pairs or self-passing patterns.
Monitor for jailed processes that acquire write access to paths under /, /etc, or other host-only directories outside their configured path.

How to Mitigate CVE-2026-101306

Immediate Actions Required

Apply the FreeBSD base system patch from FreeBSD-SA-26:66.jail and reboot affected hosts to load the fixed kernel.
Inventory jail hosts running FreeBSD 14.4, 14.5, 15.0, and 15.1 using freebsd-version -k and prioritize multi-tenant jail servers.
Review jail.conf for jails that share filesystem paths or Unix domain socket directories with other jails and isolate them where possible.

Patch Information

FreeBSD has issued fixed kernels through the standard freebsd-update channel and source tree for the 14.4, 14.5, 15.0, and 15.1 branches. Administrators should run freebsd-update fetch install followed by a reboot, or rebuild from the patched source as described in the vendor advisory. The patch modifies the SCM_RIGHTS receive path to copy the FD_RESOLVE_BENEATH restriction onto the new descriptor-table entry.

Workarounds

Where immediate patching is not possible, avoid granting jailed workloads access to shared Unix domain sockets that cross jail boundaries.
Restrict jail configurations so that distinct tenants do not share filesystem mount points through which AF_UNIX sockets could be reached.
Reduce reliance on FD_RESOLVE_BENEATH as the sole confinement mechanism; combine it with narrow jail path roots and read-only nullfs mounts.

bash

# Apply the FreeBSD security update and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now

# Verify the running kernel version after reboot
freebsd-version -k
uname -a