SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-101306 is a critical privilege escalation vulnerability affecting FreeBSD's SCM_RIGHTS mechanism for file descriptor passing over Unix domain sockets. The vulnerability stems from improper preservation of the FD_RESOLVE_BENEATH flag during descriptor transfer, allowing a process to clear filesystem root restrictions by sending a descriptor to itself. This is particularly severe in containerized and jailed environments where filesystem isolation is a critical security boundary. Processes running in jails can exploit this to escape their confined filesystem root, potentially gaining unauthorized access to the host system's filesystem. The CVSS 9.8 critical rating reflects the ease of exploitation and severe impact on system confidentiality, integrity, and availability.
While Casky currently shows zero matching skills for this specific CVE, practitioners using Casky's AI-driven analysis would benefit from the platform's extended reasoning capabilities to identify related attack patterns mapped to CWE-273 (Improper Check for Dropped Privileges) and CWE-281 (Improper Preservation of Permissions). A security practitioner monitoring this vulnerability would investigate system calls related to SCM_RIGHTS operations, Unix domain socket communications, and jail escape attempts using Casky's contextual threat intelligence. Future skill development should focus on detecting suspicious file descriptor operations between processes, unusual socket-based IPC patterns in containerized environments, and filesystem root restriction bypasses—attack patterns that would typically fall under Privilege Escalation and Defense Evasion techniques in the MITRE ATT&CK framework.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-101306. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation