CVE-2026-49419

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.

• CWE-911

• https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.ascVendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49413The Linuxulator determined whether a binary was set-user-ID …7.1
• CVE-2026-49414The ELF image activator cleared per-process ASLR preference …7.8
• CVE-2026-49415During execve(2) of a SUID binary, the new virtual address s…8.8
• CVE-2026-49416The CONS_HISTORY ioctl handler did not adequately validate t…7.8
• CVE-2026-49417Second, the audio buffer backing a mapping could be freed wh…7
• CVE-2026-49418When msync(MS_INVALIDATE) is called on a mapping of an unman…8.8
• CVE-2026-4942IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…7.5
• CVE-2026-49420The RTSP handler in libalias rewrote outgoing packets into a…8.8
• CVE-2026-49421The kernel function that implements unlinkat(2) and funlinka…7.1
• CVE-2026-49422The RACK setsockopt(2) handler drops the connection lock in …8.4
• CVE-2026-49423When building the iovec array for a received TLS 1.2 CBC rec…3.3
• CVE-2026-49424The Linux waitid() implementation translates a FreeBSD sigin…5.5