---
cve: "CVE-2026-101306"
severity: "CRITICAL"
cvss: 9.8
epss: "0.3%"
vendor: "FreeBSD"
kev: false
exploited: false
published: "2026-10-15 07:17:57"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-10T16:24:52+01:00"
---

# CVE-2026-101306

> 9.8 CRITICAL

## Beschreibung

SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

## CNA-Record (Kanon, cvelistV5)

- CNA: **freebsd**
- State: PUBLISHED
- Stand: 2026-10-16 18:33:15

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-273** — Improper Check for Dropped Privileges
  The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
- **CWE-281** — Improper Preservation of Permissions
  The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

## BSI-Hinweise (deutsch)

- [FreeBSD Project FreeBSD OS: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3664) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände zu verursachen.

## Referenzen

- <https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-101306/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_