# CVE-2026-101305: FreeBSD jail filesystem root escape via renameat(2)

Source: https://junglewise.ai/threats/cve-2026-101305-renameat-2-did-not-enforce-fd-resolve-beneath-on-its-directory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-101305 · Severity: high · CVSS 8.8 · Published 2026-10-15

FreeBSD's jail system provides lightweight virtualization that isolates processes to a restricted filesystem view. A flaw in the renameat(2) system call fails to enforce directory access restrictions, allowing a jailed process that receives a file descriptor from another jail to escape its filesystem confinement and access files outside the intended root directory.

Technologies: [Freebsd](https://junglewise.ai/threats/technologies/freebsd). Vendors: [Freebsd](https://junglewise.ai/threats/vendors/freebsd).

## Quick answers

**Is CVE-2026-101305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101305 being exploited in the wild.

**How severe is CVE-2026-101305?** High severity, with a CVSS score of 8.8, published 15 October 2026.

**Which products and versions are affected?** Freebsd All supported versions prior to patches.

**Is there a fix for CVE-2026-101305?** Yes: fixed in FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, or later stable branches. Until then: Systems that do not pass directory file descriptors into jails are not affected. No workaround is available for systems that rely on inter-jail file descriptor passing.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29","note":"FreeBSD Security Advisory SA-26:66 published"},{"kind":"patched","at":"2026-09-29","note":"Patches released for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.5, releng/14.4"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101305 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-101305?** Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10, or later stable branches

Systems that do not pass directory file descriptors into jails are not affected. No workaround is available for systems that rely on inter-jail file descriptor passing.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29","note":"FreeBSD Security Advisory SA-26:66 published"},{"kind":"patched","at":"2026-09-29","note":"Patches released for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.5, releng/14.4"}]

## Technical details

The renameat(2) syscall does not properly enforce the FD_RESOLVE_BENEATH flag on its directory arguments, which is meant to restrict path lookups to within a referenced directory. An attacker in a jail can use renameat(2) to rename a directory relative to a restricted file descriptor, then use fchdir(2) to change into that directory and escape the jail root. Exploitation requires the target directory to reside on a filesystem also reachable from the jail's root.

## Affected products

- FreeBSD FreeBSD All supported versions prior to patches

## References

- [https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc](https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc)

## Related threats

- [FreeBSD kqueue out-of-bounds read in fork copy](https://junglewise.ai/threats/cve-2026-58100-kqueue-fork-copy-knote-indexed-into-the-child-s-file-descriptor)
- [FreeBSD kernel kqueue memory safety bugs in copy-on-fork](https://junglewise.ai/threats/cve-2026-58099-when-copying-knotes-from-a-parent-kqueue-to-a-child-the-copy-code)
- [FreeBSD kernel heap out-of-bounds access in semop(2)](https://junglewise.ai/threats/cve-2026-58098-when-semop-2-blocks-waiting-for-a-semaphore-condition-it-releases)
- [FreeBSD sound(4) use-after-free in buffer resize TOCTOU race](https://junglewise.ai/threats/cve-2026-101308-when-an-audio-channel-s-buffer-needs-to-be-resized-the-sound-4)
- [FreeBSD RACK stack buffer overflow in tcp_rack](https://junglewise.ai/threats/cve-2026-101307-when-the-pcm-sample-array-needs-to-grow-the-rack-stack-doubles-a)