CVE-2026-101303: IPv6 UDP sendto(2) bypasses jail loopback restriction
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.
A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Classic non-VNET jails are exposed. The affected path is IPv6 UDP sending from an unconnected socket.
What does an attacker need to exploit it?
An attacker needs the ability to run a process in a classic jail and send IPv6 UDP datagrams to a service listening on the host's IPv6 loopback address.
What isolation boundary can be bypassed?
The issue bypasses the jail policy that should rewrite a loopback destination to the jail's primary IPv6 address. This can allow a jailed process to reach host services bound to the IPv6 loopback address.