When the fdescfs filesystem is mounted inside a FreeBSD jail with the nodup option, opening a file descriptor from /dev/fd/N yields a descriptor that does not have the expected FD_RESOLVE_BENEATH flag or Capsicum capability rights. This weakness allows a process that has been given a directory file descriptor from another jail to escape the jail's filesystem root restriction. The flaw is classified as CWE-273, an improper authorization defect that can result in unauthorized access to or modification of data outside a protected context.

The vulnerability affects FreeBSD and its jail implementation. No specific product versions are listed; the issue applies to all instances where fdescfs was mounted with the nodup option in a jail. Users should review the FreeBSD security advisory for any available patch or update.

The exploit requires a process within a jail to obtain a directory descriptor from another jail, implying a local-assignment or cross‑jail privilege scenario. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. However, the impact of a successful escape is significant, granting the attacker filesystem access beyond the jail boundary and potential elevation of privileges within the host environment. The lack of a publicly documented CVSS score limits precise severity assessment, but the nature of the flaw suggests a high potential for compromise if the conditions are met.