Critical FreeBSD Jail Escape Vulnerability (CVE-2025-15576) Exposes Host Systems to Full Filesystem Access
A severe vulnerability in FreeBSD’s jail subsystem, tracked as CVE-2025-15576, allows attackers to bypass isolation mechanisms and gain unauthorized access to the host’s underlying filesystem. Disclosed on February 24, 2026, the flaw affects FreeBSD 14.3 and 13.5, enabling a complete jailbreak under specific configurations.
FreeBSD jails use OS-level virtualization to restrict processes to isolated environments, similar to chroot. However, CVE-2025-15576 exploits a flaw in how directory file descriptors are handled when two sibling jails interact. If an administrator configures these jails to share a directory via a nullfs mount and establishes a Unix domain socket connection between them, malicious processes can exchange directory descriptors. The kernel fails to validate these descriptors properly, allowing a process to access directories outside its jail effectively breaking filesystem isolation.
The impact is severe: attackers with control over processes in both jails can read, modify, or exfiltrate sensitive system files, escalate privileges, or compromise the host. No temporary workarounds exist; patching is mandatory.
Administrators using binary distributions (e.g., FreeBSD 14.3/13.5 RELEASE) must run:
freebsd-update fetch
freebsd-update install
followed by a reboot to apply the fix. Source-based installations require downloading the patch from FreeBSD’s security portal, verifying its PGP signature, and recompiling the kernel. Systems must run a patched kernel dated after February 24, 2026, to ensure protection.
Source: https://cybersecuritynews.com/freebsd-vulnerability/
FreeBSD cybersecurity rating report: https://www.rankiteo.com/company/freebsd
"id": "FRE1772195261",
"linkid": "freebsd",
"type": "Vulnerability",
"date": "2/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Users of FreeBSD 14.3 and 13.5 '
'with jail configurations',
'industry': 'Technology/Software',
'location': 'Global',
'name': 'FreeBSD',
'type': 'Operating System'}],
'attack_vector': 'Local (Jail Escape)',
'data_breach': {'data_exfiltration': 'Possible',
'sensitivity_of_data': 'High (system-level access)',
'type_of_data_compromised': 'System files, configuration '
'data, sensitive host '
'information'},
'date_publicly_disclosed': '2026-02-24',
'description': 'A severe vulnerability in FreeBSD’s jail subsystem, tracked '
'as CVE-2025-15576, allows attackers to bypass isolation '
'mechanisms and gain unauthorized access to the host’s '
'underlying filesystem. The flaw affects FreeBSD 14.3 and '
'13.5, enabling a complete jailbreak under specific '
'configurations where sibling jails share a directory via a '
'nullfs mount and establish a Unix domain socket connection. '
'The kernel fails to validate directory descriptors properly, '
'allowing processes to access directories outside their jail, '
'breaking filesystem isolation.',
'impact': {'data_compromised': 'Sensitive system files (read, modify, or '
'exfiltrate)',
'operational_impact': 'Privilege escalation, host compromise, '
'potential full system takeover',
'systems_affected': 'FreeBSD 14.3 and 13.5 host systems with '
'misconfigured jails'},
'post_incident_analysis': {'corrective_actions': 'Kernel patch to validate '
'directory descriptors, '
'updated documentation on '
'secure jail configurations.',
'root_causes': 'Improper validation of directory '
'file descriptors in the FreeBSD '
'kernel when handling interactions '
'between sibling jails with shared '
'nullfs mounts and Unix domain '
'sockets.'},
'recommendations': 'Immediately patch affected FreeBSD systems, audit jail '
'configurations, and avoid sharing directories between '
'sibling jails via nullfs mounts unless absolutely '
'necessary.',
'references': [{'source': 'FreeBSD Security Advisory'}],
'response': {'containment_measures': 'Patching via freebsd-update or kernel '
'recompilation',
'remediation_measures': 'Apply patches dated after February 24, '
'2026, and reboot systems'},
'title': 'Critical FreeBSD Jail Escape Vulnerability (CVE-2025-15576) Exposes '
'Host Systems to Full Filesystem Access',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2025-15576'}