CVE-2026-101304: Multiple jail filesystem root escapes
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Affected Software
Event History
Frequently Asked Questions
Which jailed processes are exposed to this issue?
A process in a jail is exposed if it has received a directory file descriptor from another jail and fdescfs is mounted in that jail with the "nodup" option.
What does an attacker need to exploit the escape?
The attacker needs access to a directory file descriptor received from another jail. They can then open /dev/fd/N to obtain a descriptor that lacks the original descriptor's FD_RESOLVE_BENEATH constraint or Capsicum capability rights.
Is a jail affected by default?
The issue requires fdescfs to be mounted with the "nodup" option. The provided information does not state whether that option is used by default.
How can an administrator identify potentially affected jails?
Check for jails where fdescfs is mounted using the "nodup" option, and identify processes in those jails that may receive directory file descriptors from another jail.