CVE-2026-49421 Overview
CVE-2026-49421 affects the FreeBSD kernel implementation of unlinkat(2) and funlinkat(2). The kernel function validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, and path resolution was not restricted as intended. A process using AT_RESOLVE_BENEATH to confine deletions to a directory tree can resolve paths above the starting directory. Callers that depend on this flag for containment may delete files outside the intended directory tree. The weakness is classified under [CWE-273: Improper Check for Dropped Privileges].
Critical Impact
Applications relying on AT_RESOLVE_BENEATH for sandboxing file deletions can be induced to delete files outside their intended directory scope.
Affected Products
- FreeBSD operating system
- Kernel implementations of unlinkat(2) and funlinkat(2) syscalls
- Applications depending on AT_RESOLVE_BENEATH containment semantics
Discovery Timeline
- 2026-08-19 - CVE-2026-49421 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-49421
Vulnerability Analysis
The AT_RESOLVE_BENEATH flag instructs the kernel to reject path resolution steps that escape a starting directory. Callers use the flag to sandbox filesystem operations within a chosen subtree. In the affected FreeBSD kernel code, unlinkat(2) and its file-descriptor variant funlinkat(2) accepted the flag as a valid input but did not forward it into the internal namei-style path lookup routine.
Because the flag never reached the resolver, no boundary checks were performed during path traversal. Components like .. segments or absolute paths were followed normally. The syscalls returned success for deletions that should have been rejected as escapes. The issue is a containment bypass rather than a memory-safety flaw, and it maps to [CWE-273] where a privilege or restriction check is not correctly enforced through the code path.
Root Cause
The root cause is a missing argument propagation in the unlinkat and funlinkat implementations. The flag argument was validated at the syscall entry, then discarded before the underlying path lookup was invoked. The resolver defaulted to unrestricted traversal semantics.
Attack Vector
Exploitation requires a local process that can invoke unlinkat(2) or funlinkat(2) and that targets code trusting AT_RESOLVE_BENEATH. An attacker with the ability to influence the path argument passed to a privileged or sandboxed helper can supply a path containing .. segments or an absolute component. The helper deletes a file outside the intended directory tree even though it requested containment. Refer to the FreeBSD Security Advisory for authoritative technical details.
Detection Methods for CVE-2026-49421
Indicators of Compromise
- Unexpected deletion of files outside a service's working directory or chroot-like scope
- Audit records showing unlinkat or funlinkat calls with path arguments containing .. or absolute prefixes from sandboxed processes
- Application logs reporting missing files that a containment-aware helper claims to have deleted safely
Detection Strategies
- Enable FreeBSD audit(4) and monitor AUE_UNLINKAT and AUE_FUNLINKAT events for paths that traverse above the base directory descriptor
- Correlate syscall telemetry from DTrace probes on unlinkat and funlinkat with the calling process's expected working scope
- Review code that passes user-controlled path fragments to unlinkat with AT_RESOLVE_BENEATH and flag hosts running unpatched FreeBSD kernels
Monitoring Recommendations
- Track kernel version on FreeBSD hosts and alert when systems remain below the fixed release specified in the advisory
- Instrument privileged file-management daemons to log the resolved absolute path prior to invoking unlinkat
- Add integrity monitoring on directories that must not be modified by sandboxed services
How to Mitigate CVE-2026-49421
Immediate Actions Required
- Apply the FreeBSD kernel update referenced in FreeBSD-SA-26:42.unlinkat and reboot affected systems
- Audit application code that relies on AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) for containment assumptions
- Restrict which local users and services can invoke privileged file-management helpers until patching completes
Patch Information
FreeBSD has issued a security advisory that provides the corrected kernel binaries and source patch for supported releases. The fix ensures the AT_RESOLVE_BENEATH flag is propagated into the underlying path lookup so escape attempts are rejected. Consult the FreeBSD Security Advisory for the exact affected versions, patch commits, and upgrade procedure.
Workarounds
- Validate and canonicalize path arguments in userspace before calling unlinkat rather than relying solely on AT_RESOLVE_BENEATH
- Run untrusted file operations inside a Capsicum sandbox or a dedicated jail with a minimal filesystem view
- Use directory file descriptors that point at a tightly scoped subtree and reject any path component equal to .. in application code
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
