A reference count underflow in FreeBSD’s jail subsystem allows a local user to cause a prison structure to be freed while still in use, which can trigger a kernel panic on the host and, when the exploit originates from within a jail, can elevate the user’s privileges to those of the host system.

The vulnerability affects FreeBSD operating systems that implement jails; specific version details are not provided, implying that any release with jail support could be vulnerable.

The attack vector is local, requiring the ability to run jail commands with the JAIL_AT_DESC flag. The CVSS score of 8.8 indicates a high severity, while the EPSS score of <1% suggests a low probability of exploitation. The CISA KEV catalog does not list this flaw, implying no known remote exploitation, but the vulnerability still poses a local privilege escalation risk when a user can manipulate jail descriptors.