CVE-2026-49419
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in FreeBSD's kern_jail_set() and kern_jail_get() when the JAIL_AT_DESC flag is used. Double release of the caller's current prison reference can lead to a reference count underflow and use-after-free.
Risk Assessment
An unprivileged local user can trigger a system panic or, within a jail, potentially escalate privileges.
Recommendation
Apply the vendor patch for FreeBSD. Restrict local user access where feasible.
Original NVD description (English source)
When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.