Description
The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted.
A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree.
A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree.
Published:
2026-08-19
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| FreeBSD | FreeBSD | unknown |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Wed, 19 Aug 2026 05:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree. | |
| Title | unlinkat(2) ignores AT_RESOLVE_BENEATH flag | |
| Weaknesses | CWE-273 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: freebsd
Published:
Updated: 2026-08-19T05:25:43.003Z
Reserved: 2026-05-29T20:24:28.616Z
Link: CVE-2026-49421
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-19T06:17:41.160
Modified: 2026-08-19T06:17:41.160
Link: CVE-2026-49421
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-273
Improper Check for Dropped Privileges