Quick answers
- Is CVE-2026-101305 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-101305 being exploited in the wild.
- How severe is CVE-2026-101305?
- High severity, with a CVSS score of 8.8, published 15 October 2026.
- Which products and versions are affected?
- Freebsd All supported versions prior to patches.
- Is there a fix for CVE-2026-101305?
- Yes: fixed in FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, or later stable branches. Until then: Systems that do not pass directory file descriptors into jails are not affected. No workaround is available for systems that rely on inter-jail file descriptor passing.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29","note":"FreeBSD Security Advisory SA-26:66 published"},{"kind":"patched","at":"2026-09-29","note":"Patches released for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.5, releng/14.4"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-101305 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-101305?
- Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, or later stable branches
Systems that do not pass directory file descriptors into jails are not affected. No workaround is available for systems that rely on inter-jail file descriptor passing.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29","note":"FreeBSD Security Advisory SA-26:66 published"},{"kind":"patched","at":"2026-09-29","note":"Patches released for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.5, releng/14.4"}]
Technical details
The renameat(2) syscall does not properly enforce the FD_RESOLVE_BENEATH flag on its directory arguments, which is meant to restrict path lookups to within a referenced directory. An attacker in a jail can use renameat(2) to rename a directory relative to a restricted file descriptor, then use fchdir(2) to change into that directory and escape the jail root. Exploitation requires the target directory to reside on a filesystem also reachable from the jail's root.
Affected products
- FreeBSD FreeBSD All supported versions prior to patches