Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-101305

renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments

Risk score
60/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.4%
Published
15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that …
Affected
Freebsd
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: FreebsdTHE FLAWSTHE FIXCVE-2026-101305Renameat(2) did not enforceFD_RESOLVE_BENEATH on itsdirectory argumentsCVSS 8.8 · EPSS 0%CVE-2026-101306SCM_RIGHTS file descriptorpassing did not preserveFD_RESOLVE_BENEATH when…CVSS 9.8 · EPSS 0%CVE-2026-101307Heap buffer overflowCVSS 9.1 · EPSS 0%CVE-2026-101303The IPv6 UDP send path forunconnected sockets did notapply the jail policy of…CVSS 7.5 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedFreebsdAMBER · PATCH THIS WEEKFreebsdSCM_RIGHTS file descriptorpassing did not preserveFD_RESOLVE_BENEATH when adescriptor was transferred. Aprocess could clear therestriction by sending thedescriptor to itself over a Unix…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-273 (CWE-273)3 other warnings in 30 days →Same productEarlier Freebsd warnings6 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freebsd: Amber, patch this week. SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to …

The flaws

  • CVE-2026-101305: Renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments (CVSS 8.8 · EPSS 0%)
  • CVE-2026-101306: SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-101307: Heap buffer overflow (CVSS 9.1 · EPSS 0%)
  • CVE-2026-101303: The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a… (CVSS 7.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Freebsd

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.8 high

References

Original description

renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

Last activity 15 Oct 2026. Patch Forecast updates every hour.