The vulnerability arises when kern_jail_set() and kern_jail_get() release the reference to the caller's current prison before looking up the jail descriptor with the JAIL_AT_DESC flag. If the descriptor lookup fails, error-handling code releases the same reference again, causing a reference count underflow. This can lead to the prison structure being freed while still in use. On the jail host, this typically results in an immediate kernel panic. However, if exploited from within a jail, it may allow an unprivileged local user to escalate privileges.

An unprivileged local user can cause a prison reference count underflow, leading to use-after-free conditions. On the jail host, this results in a kernel panic causing denial of service. Within a jail, the vulnerability may be exploited for privilege escalation, potentially allowing the attacker to gain higher privileges than intended.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict unprivileged local user access and avoid running untrusted code within jails. Monitor vendor channels for official patches or temporary mitigations.