FreeBSD CVE-2026-49419

The vulnerability is triggered only when the JAIL_AT_DESC flag is explicitly passed to the jail(2) syscall family (kern_jail_set or kern_jail_get), and only when the subsequent jail descriptor lookup fails - an error condition the attacker can deliberately engineer by passing an invalid descriptor. The attacker must hold a local user account on the affected system; no network-only access path is present in the description. For the more severe privilege escalation outcome, the attacker must already be executing within a FreeBSD jail (not on the bare host). The panic outcome can be triggered from the host by any unprivileged local user. Limiting factors include: local user account required, the JAIL_AT_DESC flag must be used (non-default for most applications), and jail escape exploitation requires UAF weaponization which is non-trivial. SSVC Automatable=no confirms that scripted mass exploitation is not straightforward. Systems where untrusted users lack shell access or cannot invoke jail(2) syscalls are not exposed to the privilege escalation path.

The provided CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) conflicts with several aspects of the description and warrants scrutiny. AV:N (Network) is inconsistent with 'unprivileged local user' triggering a kernel syscall - jail API calls are local system calls even when the user has reached the system via SSH; AV:L is more defensible. AC:L (Low Complexity) understates the difficulty of exploiting the UAF for privilege escalation, which requires reliably triggering a failed descriptor lookup and then winning the use-after-free race - AC:H is more appropriate. S:U (Unchanged) ignores the jail-escape scenario that would cross the jail/host boundary, making S:C the correct choice for that vector. EPSS at 0.16% (5th percentile) is very low, indicating the community has not yet seen exploitation tooling emerge. SSVC Exploitation is 'none' and Automatable is 'no', confirming no widespread scanning or scripted exploitation. Despite SSVC's 'total' technical impact, the realistic short-term risk is moderate: the panic path is easy to trigger (reliable denial-of-service for jail hosts), while the privilege escalation path requires more sophisticated UAF exploitation and is limited to users already inside a jail. Priority should be given to patching systems where untrusted users run inside jails.

An attacker with a low-privilege shell account inside a FreeBSD jail passes a crafted JAIL_AT_DESC descriptor to kern_jail_get() or kern_jail_set(), deliberately causing the descriptor lookup to fail. The double-release drives the current prison's reference count below zero, and the allocator frees the prison structure. The attacker then races to reclaim the freed memory with controlled data, potentially corrupting kernel pointers to redirect execution flow and escape the jail boundary, gaining host-level privileges. No public exploit code has been identified at time of analysis.