{"id":"CVE-2026-101305","aliases":["EUVD-2026-101866","GHSA-crp4-cfvg-6vr3"],"status":"published","title":"Multiple jail filesystem root escapes","description":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00232,"percentile":0.14139,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-273"],"published":"2026-10-15T06:46:16Z","modified":"2026-10-20T00:20:16Z","products":[{"vendor":"freebsd","product":"freebsd"}],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc","tags":["vendor-advisory","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101305"},{"url":"https://github.com/advisories/GHSA-crp4-cfvg-6vr3"}],"sources":{"cve":[{"id":"CVE-2026-101305","title":"Multiple jail filesystem root escapes","description":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","status":"published","published":"2026-10-15T06:46:16.471Z","modified":"2026-10-16T18:30:32.048Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:20:10.143031Z"}],"euvd":[{"id":"EUVD-2026-101866","description":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","status":"published","published":"2026-10-15T06:46:16Z","modified":"2026-10-16T18:30:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:03.938875Z"}],"ghsa":[{"id":"GHSA-crp4-cfvg-6vr3","title":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process...","description":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","status":"published","published":"2026-10-15T09:30:32Z","modified":"2026-10-16T21:33:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T15:13:52.91817Z"}],"nvd":[{"id":"CVE-2026-101305","description":"renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.\n\nA process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.","status":"published","published":"2026-10-15T07:17:57.663Z","modified":"2026-10-20T00:20:16.62Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:12:59.328869Z"}]}}