Is CVE-2026-101304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101304 being exploited in the wild.

How severe is CVE-2026-101304?

High severity, with a CVSS score of 7.1, published 15 October 2026.

Which products and versions are affected?

Freebsd All supported versions; fixed in 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, and stable branches.

How is CVE-2026-101304 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-101304?

Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101304: FreeBSD jail fdescfs filesystem root escape via FD_RESOLVE_BENEATH bypass

CVE-2026-101304 · Severity: high · CVSS 7.1 · Published 2026-10-15

FreeBSD jails isolate processes to prevent access outside a confined filesystem root, a key security feature for multi-tenant systems. A flaw in the fdescfs filesystem handler allows a jailed process to bypass these restrictions when the parent process passes a directory descriptor into the jail. An attacker can escape the jail's filesystem boundaries and access files outside the intended restricted area.

Technologies: Freebsd. Vendors: Freebsd.

Quick answers

Is CVE-2026-101304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101304 being exploited in the wild.
How severe is CVE-2026-101304?: High severity, with a CVSS score of 7.1, published 15 October 2026.
Which products and versions are affected?: Freebsd All supported versions; fixed in 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, and stable branches.
Is there a fix for CVE-2026-101304?: Yes: fixed in FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, stable/15-n285682, stable/14-n275243. Until then: No workaround is available; however, systems that do not pass directory file descriptors into jails are not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101304 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-101304?: Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, stable/15-n285682, stable/14-n275243

No workaround is available; however, systems that do not pass directory file descriptors into jails are not affected.

Technical details

When fdescfs(4) is mounted in a jail with the "nodup" option, opening /dev/fd/N does not inherit the FD_RESOLVE_BENEATH flag or Capsicum capability rights from descriptor N. This allows a jailed process that has received a directory file descriptor from another jail to bypass the FD_RESOLVE_BENEATH restriction and escape the jail's filesystem root. The vulnerability affects all supported FreeBSD versions and requires the attacker to receive a directory file descriptor in the jail context.

Affected products

FreeBSD FreeBSD All supported versions; fixed in 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, and stable branches

Timeline

2026-09-29: disclosed
2026-09-29: patched
2026-10-15: advisory

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.