CVE-2026-101306Critical· 9.8▾ MidnightSCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
— → 9.8
none → critical
0.2% → 0.3%
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101305High· 8.8renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments
CVE-2026-101304High· 7.1When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a di…
CVE-2026-58089High· 7.8When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes
CVE-2026-101309High· 7.0The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
CVE-2026-101310High· 7.0The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
CVE-2026-101311High· 7.0The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync