CVE-2026-49419 — HIGH (8.8)

Vulnerability Description

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Freebsd	Freebsd	15.0

Related Weaknesses (CWE)

CWE-911

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.ascVendor Advisory

FAQ

What is CVE-2026-49419?

CVE-2026-49419 is a vulnerability with a CVSS score of 8.8 (HIGH). When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup fail...

How severe is CVE-2026-49419?

CVE-2026-49419 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-49419?

Check the references section above for vendor advisories and patch information. Affected products include: Freebsd Freebsd.