CVE-2026-101306

Summary

A flaw in SCM_RIGHTS file descriptor passing allows processes to escape jail filesystem restrictions by clearing the FD_RESOLVE_BENEATH flag when transferring descriptors between processes. This enables jailed processes to access files outside their designated root directory.

Exploitability

Exploitation requires a process within a jail to receive a directory file descriptor from another jail and then send it to itself over a Unix domain socket, which is moderately difficult but achievable with proper setup.

Blast radius

The impact could be severe across all systems using jailed environments where processes can receive and transfer directory descriptors, potentially allowing full system compromise by escaping the jail boundaries.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to 2.590 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.