FreeBSD Kernel CVE-2026-49421

Exploitation requires a local process running with at least low-level user privileges (PR:L per CVSS). The critical prerequisite is that the vulnerable call path is exercised: the target application must use unlinkat(2) or funlinkat(2) and pass AT_RESOLVE_BENEATH as a security boundary, and the attacker must be able to influence the path argument to include traversal components (e.g., '../../'). Systems where no application relies on AT_RESOLVE_BENEATH for containment are not exposed to elevated risk beyond what already exists. The vulnerability does NOT allow privilege escalation to root on its own. Limiting factors: local access required, application must specifically use AT_RESOLVE_BENEATH for containment semantics, and the attacker must have influence over path arguments. Exploitation is not automatable across the network.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H reflects a local, low-complexity attack requiring only user-level privilege - consistent with the nature of the syscall interface. Real-world exploitation is narrowly scoped: only processes that explicitly use AT_RESOLVE_BENEATH as a security boundary for unlinkat/funlinkat are affected; applications that do not rely on this flag for containment are not exposed to increased risk. EPSS at 0.13% (3rd percentile) correctly reflects the niche preconditions - an attacker must control a local process AND the target application must be using AT_RESOLVE_BENEATH as a sandbox mechanism. No KEV listing and no POC code have been identified. The Availability impact rated High reflects the potential deletion of critical files if containment is bypassed, which could undermine system stability. The 'Information Disclosure' tag in the intelligence feed appears to be a misclassification; the description and CVSS metrics (C:N) confirm no confidentiality impact.

A local user-level process - such as a container runtime, archive extractor, or sandboxed file manager - opens a directory fd and invokes unlinkat(dirfd, '../../etc/passwd', AT_RESOLVE_BENEATH), expecting the flag to prevent resolution above the directory root. Because the kernel drops the flag before path lookup, the traversal succeeds and the file is deleted outside the intended tree. No public exploit code exists, and exploitation requires attacker influence over path arguments supplied to a process that uses AT_RESOLVE_BENEATH for containment.