renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. (CVE-2026-101305)

CVE-2026-101305 describes a vulnerability in the renameat(2) system call where it fails to enforce the FD_RESOLVE_BENEATH flag on directory arguments. This flaw allows a jailed process to rename directories relative to restricted descriptors and subsequently escape the jail root using fchdir(2), provided the directory resides on a filesystem reachable from the jail's root. The vulnerability can be exploited by a process in a jail that has received a directory file descriptor from another jail, enabling it to circumvent filesystem root restrictions imposed by the jail.

Successful exploitation allows a jailed process to escape its filesystem root restriction, potentially gaining unauthorized access to parts of the filesystem outside the jail. This can lead to confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the sharing of directory file descriptors between jails and limit the use of renameat(2) in jailed environments where possible.