A reference count underflow in FreeBSD’s jail subsystem allows a local user to cause a prison structure to be freed while still in use, which can trigger a kernel panic on the host and, when the exploit originates from within a jail, can elevate the user’s privileges to those of the host system.

The vulnerability affects FreeBSD operating systems that implement jails; specific version details are not provided, implying that any release with jail support could be vulnerable.

The attack vector is local, requiring the ability to run jail commands with the JAIL_AT_DESC flag; no public exploits are known and the EPSS score is unavailable, but the CISA KEV list does not list this flaw, indicating no reported remote exploitation but a potential local escalation risk.