CVE-2026-101305 in FreeBSD
Summary
by MITRE • 10/15/2026
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical failure in the FreeBSD operating system kernel regarding the enforcement of security restrictions on the renameat(2) system call, specifically concerning the FD_RESOLVE_BENEATH flag. This flag is designed to prevent processes from resolving file paths that escape their designated root directory, thereby maintaining the integrity of filesystem jails which are intended to isolate processes and limit their access to specific parts of the file hierarchy. The core technical flaw lies in the fact that while other system calls properly enforced this restriction on directory arguments used for path resolution, renameat(2) failed to apply these same checks when operating with restricted file descriptors. This inconsistency created a gap in the security model where the kernel did not validate whether the target of a rename operation was located outside the allowed jail boundaries when such validation should have been mandatory based on the flags associated with the directory descriptor provided by the caller.
The operational impact of this vulnerability is severe, as it allows for a complete escape from the confines of a userland jail environment. A malicious or compromised process operating within a restricted jail can exploit this flaw to manipulate filesystem structures in ways that were previously prohibited. By leveraging the lack of enforcement on directory arguments during rename operations, an attacker can restructure directories in a manner that facilitates movement outside the jail's root partition. This is particularly dangerous because it undermines one of the primary security guarantees provided by jails: the isolation of processes from the rest of the system and other users. If successful, this escape could lead to unauthorized access to sensitive files, privilege escalation if combined with other vulnerabilities, or broader compromise of the host system depending on the privileges held by the jailed process.
The exploitation scenario typically requires specific conditions to be met for success. The attacker must possess a directory file descriptor that is subject to jail restrictions, often obtained from another context within the same environment. Furthermore, the target directories involved in the rename operation must reside on a filesystem that remains reachable and accessible from the jail's root perspective. This means that while the direct path might be blocked by standard checks, the ability to alter directory structures via renameat(2) without proper validation allows the attacker to create symbolic links or move directories into positions where they can subsequently use fchdir(2) to change their working directory to a location outside the jail's permitted scope. This sequence effectively bypasses the filesystem root restriction that jails are designed to enforce, granting the process visibility and access to resources it should not have.
To mitigate this vulnerability, system administrators must ensure that all affected systems are updated with patches released by FreeBSD that correct the logic within the renameat(2) implementation. These updates typically involve adding explicit checks for FD_RESOLVE_BENEATH on directory arguments similar to those present in other path resolution functions like openat or chdir. In environments where immediate patching is not feasible, strict monitoring of file system operations and limiting the privileges granted to jailed processes can reduce the risk of exploitation. Additionally, reviewing application code that utilizes renameat with restricted descriptors for potential misuse can help identify vulnerable implementations before they are targeted by attackers seeking to escape containment boundaries.
From a classification perspective, this vulnerability aligns with CWE-250, which denotes execution with unnecessary privileges, as it allows a process in a constrained environment to perform actions outside its intended scope due to insufficient enforcement of access controls. It also relates closely to CWE-787, out-of-bounds write or access, although the context is more about logical bypass than memory corruption. In terms of attack tactics, this flaw supports techniques associated with ATT&CK ID T1072, specifically software evasion mechanisms that involve manipulating file system structures to hide activities or escape detection and containment. Understanding these mappings helps security teams prioritize remediation efforts based on established industry standards for vulnerability management and threat intelligence alignment.