The FreeBSD kernel function that implements unlinkat(2) and funlinkat(2) silently discards the AT_RESOLVE_BENEATH flag that is intended to restrict path resolution to a confined subtree. Because the flag is ignored, a caller that relies on it to prevent traversal beyond a starting directory can actually resolve and delete files outside the intended tree. This flaw can allow an attacker to delete arbitrary files that are not intended to be removed, potentially erasing critical system or application data and providing a foothold for privilege escalation or denial of service.

Affected systems include any FreeBSD kernel that contains the unpatched unlinkat/funlinkat implementation. No specific kernel version numbers are listed in the available data, and the vendor product is identified simply as FreeBSD FreeBSD. Administrators should determine whether their deployments use the affected kernel and check for a newer release.

Risk and exploitability: The CVSS score of 7.1 indicates a high severity, while the EPSS score of <1% reflects a low exploitation probability as of the last assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit this flaw by invoking unlinkat(2) or funlinkat(2) with AT_RESOLVE_BENEATH from legitimate but untrusted code, leading to unintended file deletions outside the intended directory subtree. Successful exploitation would give the attacker the ability to remove critical system or application files, potentially enabling privilege escalation or denial of service.