CVE-2026-49419
Jail reference count underflow
CVSS Score
8.8
EPSS Score
0.2%
EPSS Percentile
5th
When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.
| CWE | CWE-911 |
| Vendor | freebsd |
| Product | freebsd |
| Published | Aug 19, 2026 |
| Last Updated | Aug 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for freebsd freebsd
Be the first to know when new high vulnerabilities affecting freebsd freebsd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FreeBSD / FreeBSD
15.1-RELEASE < p1 15.0-RELEASE < p11
References
Credits
Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai