SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. (CVE-2026-101306)

The vulnerability CVE-2026-101306 arises from the SCM_RIGHTS mechanism for passing file descriptors between processes via Unix domain sockets. Specifically, the FD_RESOLVE_BENEATH flag, which restricts path resolution to beneath a certain directory (used to enforce filesystem jail restrictions), is not preserved during descriptor passing. Consequently, a process confined within a jail can transfer a directory file descriptor to itself and thereby bypass the jail's filesystem root restriction, potentially escaping the jail environment. This represents a serious security flaw in the enforcement of filesystem isolation.

An attacker controlling a process inside a jailed environment can exploit this vulnerability to escape the filesystem root restriction imposed by the jail. This can lead to unauthorized access to the broader filesystem, compromising confidentiality, integrity, and availability of the system. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Unix domain sockets and limit the ability of untrusted processes to transfer file descriptors. Monitor vendor communications for updates and apply patches promptly once released.