CVE-2026-49419
When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.29%
- CWE
- CWE-911
- Published
- 2026-08-19
- Last modified
- 2026-08-20
Affected products
- FreeBSD FreeBSD
- FreeBSD FreeBSD
Weakness type
Related vulnerabilities
- CVE-2026-77587 — Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object...
- CVE-2026-19380 — Mullvad wireguard.sys IOCTL AdapterState reference count
- CVE-2024-45783 — Grub2: fs/hfs+: refcount can be decremented twice
- CVE-2024-46972 — GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence
- CVE-2024-43102 — umtx Kernel panic or Use-After-Free
- CVE-2023-6270 — Kernel: aoe: improper reference count leads to use-after-free vulnerability
- CVE-2023-5633 — Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling
- CVE-2023-2019 — A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events....