Jail Escape via Unrestricted Directory Rename Operations

CVE-2026-101305 is a privilege escalation vulnerability affecting FreeBSD's renameat(2) system call, which fails to properly enforce the FD_RESOLVE_BENEATH flag on directory arguments. This flag is critical for containerization and sandboxing, as it restricts file operations to remain beneath a specified directory descriptor. A jailed process can exploit this by renaming a directory relative to a restricted file descriptor, then using fchdir(2) to change the working directory and escape the jail's root filesystem boundary. This vulnerability is particularly severe because it enables complete jail breakout when the target directory resides on a filesystem accessible from both the jail and the host system. Organizations using FreeBSD jails for multi-tenancy, containerized workloads, or privilege separation are directly affected, as a compromised or malicious process within a jail can gain unauthorized access to the host filesystem.

While MITRE ATT&CK techniques are not formally mapped to this CVE, the attack pattern aligns with Privilege Escalation and Defense Evasion categories. Casky's Claude-powered analysis would detect exploitation attempts by identifying suspicious system call sequences: specifically, the combination of renameat(2) operations on restricted file descriptors followed by fchdir(2) calls that violate expected jail boundary constraints. A practitioner reviewing Casky findings would observe anomalous filesystem manipulation patterns—particularly directory operations that successfully traverse above their intended restriction boundaries—alongside indicators of jail escape such as processes accessing parent filesystem namespaces or mounting operations from within a confined environment. The platform's extended reasoning would correlate these behavioral indicators to surface the underlying capability: an attacker's ability to break filesystem isolation and access resources outside their intended sandbox.