CVE-2026-101304 in FreeBSD
Summary
by MITRE • 10/15/2026
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical flaw within the FreeBSD fdescfs implementation, specifically when operating under the nodup option inside a restricted environment such as a jail. The fdescfs virtual file system is designed to provide access to open file descriptors through special entries in /dev/fd/N. Under normal circumstances, this mechanism ensures that operations on these pseudo-file descriptors respect the security context and capabilities of the original descriptor. However, when the nodup option is enabled, which is intended to reduce resource usage by avoiding duplicate structures for identical underlying files, a logic error occurs during file opening operations. Specifically, when a process opens /dev/fd/N in this configuration, the resulting new file descriptor fails to inherit essential security attributes from the source descriptor N. These missing attributes include FD_RESOLVE_BENEATH and Capsicum capability rights. The absence of these inheritance mechanisms creates a significant divergence between the intended security policy and the actual runtime behavior of the kernel's virtual file system layer.
This technical flaw has severe operational implications for systems relying on jails to isolate processes from one another. A jail is designed to restrict access to specific parts of the filesystem, typically by chrooting or using other containment mechanisms that prevent escape into the host system or other jails. The FD_RESOLVE_BENEATH flag is crucial for enforcing these restrictions because it ensures that relative path resolution remains confined within the allowed directory tree. Without this flag, a process can manipulate file paths to traverse outside its designated root. Furthermore, Capsicum capability rights provide fine-grained access control by limiting what operations a file descriptor can perform. The loss of these capabilities means that even if a jail restricts certain actions on specific descriptors, those restrictions are effectively bypassed when the flawed fdescfs behavior is exploited.
An attacker who gains code execution within a compromised jail can leverage this vulnerability to escape containment. By obtaining a directory file descriptor from another jail or context and then opening /dev/fd/N with the nodup option active, the resulting descriptor lacks the necessary constraints. This allows the malicious process to perform operations that should be prohibited by the jail's security policy. For instance, it can resolve paths outside the jail root, potentially accessing sensitive configuration files, other users' data, or kernel interfaces that are normally inaccessible from within a restricted environment. This constitutes a complete failure of the isolation boundary, effectively granting the attacker privileges equivalent to those available in the broader system context rather than just the confined jail space.
From a classification perspective, this vulnerability aligns with CWE-250, which denotes execution with unnecessary privileges, and CWE-787, involving out-of-bounds write or access issues related to memory safety if exploited further, though primarily it represents an authorization bypass due to improper enforcement of security constraints. In the context of the MITRE ATT&CK framework, this flaw facilitates lateral movement within a compromised host by allowing an attacker to break out of containerized environments like jails, which is categorized under Container and Escape techniques such as T1611 or related privilege escalation vectors depending on the specific exploitation path used. The lack of proper capability inheritance directly undermines the principle of least privilege enforced by Capsicum and jail configurations.
Mitigation strategies must focus on addressing the root cause within the fdescfs implementation to ensure that security attributes are correctly propagated regardless of optimization options like nodup. System administrators should consider disabling the nodup option if it is not strictly necessary for performance, as this restores the standard behavior where descriptors inherit all relevant rights and flags. Additionally, applying vendor patches that correct the inheritance logic in the kernel source code is essential. Security teams should also audit their jail configurations to ensure they are not relying solely on fdescfs behaviors without additional layers of defense such as Capsicum capabilities or mandatory access control policies like SELinux or FreeBSD's own MAC frameworks. Regular updates and patch management remain critical, as this type of logic error in core system components can lead to significant security breaches if left unaddressed.