CVE-2026-49419: Jail reference count underflow
When the JAILATDESC flag is specified, kernjailset() and kernjailget() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time.
An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.
Affected Software
Event History
Frequently Asked Questions
Who is most at risk from this issue?
The primary privilege-escalation risk is to systems that allow unprivileged users to run inside a jail. On the jail host, triggering the flaw will generally cause an immediate kernel panic rather than privilege escalation.
What must an attacker be able to do to trigger the flaw?
An unprivileged local user must be able to invoke kern_jail_set() or kern_jail_get() with the JAIL_AT_DESC flag and cause the jail descriptor lookup to fail. The vulnerable error path then releases the caller's current prison reference twice.
What can be done if patching cannot happen immediately?
The provided information identifies unprivileged users running in jails as the privilege-escalation scenario. Restricting unprivileged access within jails can reduce exposure until a fix is applied.