When the fdescfs filesystem is mounted inside a FreeBSD jail with the nodup option, opening a file descriptor from /dev/fd/N yields a descriptor that does not have expected FD_RESOLVE_BENEATH flag or Capsicum capability rights. This weakness allows a process that has been given a directory file descriptor from another jail to escape the jail's filesystem root restriction. The flaw is classified as CWE‑273, an improper authorization defect that can result in unauthorized access to or modification of data outside a protected context.

The vulnerability affects FreeBSD 14.4 (including all patch releases), 14.5, 15.0 (including patches 15.0‑p1 through 15.0‑p13), and 15.1 (including patches 15.1‑p1 through 15.1‑p3). It applies to any jail that mounts the fdescfs filesystem with the nodup option. Systems running these releases should consult the FreeBSD security advisory for applicable patches.

Based on the description, the exploit requires a process within a jail to obtain a directory descriptor from another jail, implying a local‑assignment or cross‑jail privilege scenario. The likely attack vector is a local process within a FreeBSD jail that has access to a directory descriptor from another jail, which can use the fdescfs nodup functionality to escape the jail root. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. However, based on the description, the impact of a successful escape is significant, granting the attacker filesystem access beyond the jail boundary and potential elevation of privileges within the host environment. The CVSS score of 7.1 indicates a high severity, and with the EPSS score of less than 1 % the vulnerability is unlikely to be widely exploited. Based on the description, the nature of the flaw still suggests a high potential for compromise if the conditions are met.