The vulnerability results from the failure to preserve the FD_RESOLVE_BENEATH flag when a file descriptor is transferred via SCM_RIGHTS. By sending the descriptor to itself over a Unix domain socket, a process can clear the restriction and bypass the jail’s filesystem root boundary. This allows a jailed process to read from or write to files outside the intended jail environment, potentially exposing host configuration or enabling further compromise. The flaw is classified as CWE-273 and CWE-281.

The flaw affects FreeBSD systems that employ jails, as identified by the FreeBSD-SA-26:66.jail advisory. No specific release or version numbers are listed in the advisory, so any FreeBSD jail that accepts SCM_RIGHTS file descriptor passing could be vulnerable.

Because the exploitation requires local access within a jail and requires the attacker to transact a file descriptor over a Unix domain socket to itself, the EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 9.8 indicates critical severity. While the flaw could allow privilege escalation on the host, the limited attack vector and low exploitation probability reduce its immediate risk. However, if an attacker can compromise a jail or place malicious code inside it, they could escape the jail and compromise the host filesystem. Based on the description, the likely attack vector is local access within a jail.