Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-49419 Details

Description

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.asc	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-911	Improper Update of Reference Count	[email protected]

Affected Products

Product	Versions
freebsd freebsd	15.0 - 15.0 p1 15.0 p10 15.0 p2 15.0 p3
CPE cpe:2.3:o:freebsd:freebsd:15.0:-:::::: cpe:2.3:o:freebsd:freebsd:15.0:p1:::::: cpe:2.3:o:freebsd:freebsd:15.0:p10:::::: cpe:2.3:o:freebsd:freebsd:15.0:p2:::::: cpe:2.3:o:freebsd:freebsd:15.0:p3:::::: cpe:2.3:o:freebsd:freebsd:15.0:p4:::::: cpe:2.3:o:freebsd:freebsd:15.0:p5:::::: cpe:2.3:o:freebsd:freebsd:15.0:p6:::::: cpe:2.3:o:freebsd:freebsd:15.0:p7:::::: cpe:2.3:o:freebsd:freebsd:15.0:p8:::::: cpe:2.3:o:freebsd:freebsd:15.0:p9:::::: cpe:2.3:o:freebsd:freebsd:15.1:-:::::: cpe:2.3:o:freebsd:freebsd:15.1:rc2:::::: cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:::::: Remediation No remediation found in references.

Product

Versions

freebsd freebsd

15.0 -

15.0 p1

15.0 p10

15.0 p2

15.0 p3

CPE

cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Sep 1, 2026	Initial Analysis	[email protected]
Aug 20, 2026	CVE Modified	CISA-ADP
Aug 20, 2026	CVE Modified	CISA-ADP
Aug 19, 2026	New CVE Received	[email protected]