CVE-2026-101305: Multiple jail filesystem root escapes
renameat(2) did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Affected Software
Event History
Frequently Asked Questions
Which jailed processes are exposed to this issue?
A jailed process is exposed when it can operate on a directory located on a filesystem that is also reachable from that jail's root. A process that has received a directory file descriptor from another jail can also use the issue to escape its filesystem-root restriction.
What does an attacker need to do to escape the jail filesystem root?
The attacker needs code execution in a jail and a suitable directory file descriptor or directory on a filesystem reachable from the jail root. They can use renameat(2) relative to the restricted descriptor and then use fchdir(2) to leave the jail root.