CVE-2026-49419

⚠️ high

Summary

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate pani

Description

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time.

An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.

CVSS Score

8.8

High

EPSS Score

0.3

Exploit Probability

Published Date

2026-08-19

First Seen: 2026-08-20

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 360,673 vulnerabilities in our database.

#69,256

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 20, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai

SSVC data provided by CISA

Last Modified 2026-09-01

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-911

Vendor	Product	Status	Affected Versions
freebsd	freebsd	Affected	v15.0
freebsd	freebsd	Affected	v15.1

CVE-2026-49419

Summary

Description

📊 Relative Risk Intelligence

🎯 CISA SSVC Assessment Updated: Aug 20, 2026

📦 Affected Products 2

🔗 References 1

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-58095	⚠️ high	8.8	0.6	mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a...	2026-08-26
CVE-2026-58096	⚠️ high	8.8	0.6	LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by...	2026-08-26
CVE-2026-58097	⚠️ high	7.8	0.2	mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ...	2026-08-26
CVE-2026-49415	⚠️ high	8.8	0.2	During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated...	2026-08-19
CVE-2026-49418	⚠️ high	8.8	0.3	When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range ...	2026-08-19
CVE-2026-49420	⚠️ high	8.8	0.3	The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewr...	2026-08-19