Jail reference count underflow
Priority MEDIUM 40CWE-911Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix Fixed FreeBSD (FreeBSD): p1, p11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | 15.1-RELEASE to before p1; 15.0-RELEASE to before p11 | p1, p11 | Patch available | CNA |
- FreeBSD VendorFreeBSD Affected 15.1-RELEASE to before p1; 15.0-RELEASE to before p11 Fixed in p1, p11 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* | 15.0 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* | 15.0 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* | 15.0 p10 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* | 15.0 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* | 15.0 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* | 15.0 p4 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* | 15.0 p5 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* | 15.0 p6 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* | 15.0 p7 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* | 15.0 p8 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* Versions 15.0 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* Versions 15.0 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* Versions 15.0 p10 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* Versions 15.0 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* Versions 15.0 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* Versions 15.0 p4 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* Versions 15.0 p5 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* Versions 15.0 p6 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* Versions 15.0 p7 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* Versions 15.0 p8 Vulnerable ·FreeBSD
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* | 15.0 p9 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:* | 15.1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:* | 15.1 rc2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:* | 15.1 rc3-p1 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* Versions 15.0 p9 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:* Versions 15.1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:* Versions 15.1 rc2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:* Versions 15.1 rc3-p1 Vulnerable ·FreeBSD
Remediation
- Fix · CNA FreeBSD (FreeBSD) Fixed in p1, p11
Timeline
- 2026-10-02 Threatist record created from CVE-2026-49419
- 2026-10-03 Alias added: GHSA-w2h3-c2wj-whwm
References
More Freebsd vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-49419 · CVE Program
- CVE-2026-49419 · NVD
- FIRST EPSS
- GHSA-w2h3-c2wj-whwm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences