CVE-2026-49419

Jail reference count underflow

State: Published
Severity: 8.8 High
Published: Aug 19, 2026
Updated: Aug 20, 2026
Reserved: May 29, 2026

Description

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time.

An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-911 Improper Update of Reference Count

Affected Products

Product	Versions
FreeBSDFreeBSD	15.1-RELEASE to before p1Affected 15.0-RELEASE to before p11Affected

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.ascvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.