CVE-2026-49421 in FreeBSD
Summary
by MITRE • 08/19/2026
The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted.
A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability described involves a critical logic error within the Linux kernel's implementation of the unlinkat and funlinkat system calls, specifically concerning the handling of the AT_RESOLVE_BENEATH flag. This flag is designed to enforce path containment by ensuring that any relative path resolution remains strictly within the directory specified as the starting point for the operation. The core technical flaw lies in a failure to propagate this security constraint through the underlying path lookup mechanism. Although the kernel correctly validates the presence of the AT_RESOLVE_BENEATH flag during initial argument checking, it subsequently discards or ignores this directive when performing the actual filesystem traversal. This silent dropping of the flag means that the restrictive logic intended by the caller is never applied to the file system operations themselves, effectively nullifying the security boundary the application attempted to establish.
From a technical perspective, this represents a classic case where input validation does not translate into operational enforcement. When an application invokes unlinkat with AT_RESOLVE_BENEATH, it expects the kernel to prevent any path traversal that would escape the designated root directory using sequences such as dot-dot notation or symbolic links pointing outside the allowed scope. However, due to this implementation defect, the path resolution process proceeds without these restrictions. Consequently, a malicious actor or an application with compromised privileges can exploit this oversight by crafting paths that resolve upwards in the file system hierarchy. This allows for the deletion of files and directories located above the intended starting directory, bypassing what should have been a secure containment boundary.
The operational impact of this vulnerability is significant, particularly in environments where privilege separation or chroot-like restrictions are relied upon to limit the damage from compromised processes. If an attacker gains control over a process that utilizes unlinkat with AT_RESOLVE_BENEATH for safety, they can leverage this flaw to delete critical system files, configuration data, or other sensitive resources located outside the restricted directory tree. This leads to potential denial of service through resource destruction and may facilitate further privilege escalation if the deletion of specific security-critical files weakens the overall system integrity. The ability to arbitrarily remove files across the file system hierarchy undermines trust in application-level sandboxing mechanisms that depend on kernel-enforced path restrictions.
This vulnerability aligns with CWE-20, which describes Improper Input Validation, as the validation step was present but failed to ensure consistent enforcement throughout the execution flow. It also relates to CWE-787, Out-of-bounds Write or Access in a broader sense of accessing resources outside the intended scope, although more specifically it reflects a failure in access control logic rather than memory safety. In terms of MITRE ATT&CK frameworks, this flaw could be exploited during techniques involving file and directory manipulation, allowing adversaries to disrupt system availability or remove evidence by deleting logs and configuration files that are protected under normal circumstances.
Mitigation for this issue requires the application of kernel patches provided by distribution vendors that correct the path resolution logic to properly pass the AT_RESOLVE_BENEATH flag through to the underlying lookup functions. Until such updates are applied, administrators should monitor systems using these system calls closely and consider restricting access to unlinkat and funlinkat via mandatory access control policies like SELinux or AppArmor where feasible. Additionally, developers relying on these flags for security boundaries must assume they are ineffective in unpatched environments and implement additional application-level checks or use alternative secure APIs that do not suffer from this specific kernel defect. Regular patching of the operating system is the primary defense against exploiting this logic error to compromise file system integrity.