Is CVE-2026-101306 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101306 being exploited in the wild.

How severe is CVE-2026-101306?

Critical severity, with a CVSS score of 9.8, published 15 October 2026.

Which products and versions are affected?

Freebsd All supported versions prior to 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10.

How is CVE-2026-101306 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-101306?

Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101306: FreeBSD jail filesystem root escape via SCM_RIGHTS

CVE-2026-101306 · Severity: critical · CVSS 9.8 · Published 2026-10-15

FreeBSD jails are lightweight containers that isolate processes and restrict filesystem access. A vulnerability in how file descriptors are passed between jails allows a confined process to bypass restrictions and access files outside its intended root directory. An attacker in a jail can escape its filesystem boundaries and potentially gain unauthorized access to the host system's data and resources.

Technologies: Freebsd. Vendors: Freebsd.

Quick answers

Is CVE-2026-101306 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101306 being exploited in the wild.
How severe is CVE-2026-101306?: Critical severity, with a CVSS score of 9.8, published 15 October 2026.
Which products and versions are affected?: Freebsd All supported versions prior to 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10.
Is there a fix for CVE-2026-101306?: Yes: fixed in FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10. Until then: Systems that do not pass directory file descriptors into jails are not affected by this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101306 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-101306?: Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FreeBSD 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10

Systems that do not pass directory file descriptors into jails are not affected by this vulnerability.

Technical details

SCM_RIGHTS file descriptor passing over Unix domain sockets fails to preserve the FD_RESOLVE_BENEATH flag when a descriptor is transferred between processes. A jailed process can clear the restriction by sending a directory descriptor to itself, allowing path lookups to escape the intended root. This requires the receiving process to have obtained a directory file descriptor from another jail, but enables complete jail filesystem root bypass.

Affected products

FreeBSD FreeBSD All supported versions prior to 15.1-RELEASE-p4, 15.0-RELEASE-p14, 14.5-RELEASE-p1, 14.4-RELEASE-p10

Timeline

2026-09-29: disclosed
2026-09-29: patched: Patches released for stable/15, stable/14, releng/15.1, releng/15.0, releng/14.5, and releng/14.4

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.