FreeBSD Patches Critical Jail Escape Vulnerability CVE-2025-15576

FreeBSD administrators must patch CVE-2025-15576 immediately. This critical flaw lets attackers escape jail environments to access the host filesystem. Attackers need control of processes in two sibling jails sharing a nullfs mount. The FreeBSD Project disclosed it on February 24, 2026.

Jails provide OS-level isolation like chroot but stronger. They limit processes to specific filesystems. CVE-2025-15576 breaks this through Unix domain sockets. Malicious processes exchange directory file descriptors across jails. The kernel fails to stop filesystem lookups outside jail boundaries.

No crashes occur despite the title. Attackers gain full root filesystem access instead. They read sensitive files, modify configs, or steal data. Privilege escalation follows easily.

Vulnerability Details

The flaw hits core jail subsystems. Specific configs trigger escape.

Attack Requirements

Exploitation needs precise setup:

• Two sibling jails share nullfs mount
• Attacker controls processes in both
• Unix domain socket connects them
• Directory file descriptors exchange

Unprivileged users cannot pass fds normally. Jail configs must allow socket communication. Shared mounts create the gap.

Impact Scope

Attackers reach beyond jail roots. They access:

• Host /etc configs
• SSH keys and credentials
• Application databases
• System logs

Full host compromise follows. No user interaction needed beyond initial access.

Patch Instructions

Binary installs update easily:

freebsd-update fetch
freebsd-update install
reboot

Source builds need kernel recompilation. Verify patch date after February 24, 2026. Test jails post-reboot.

Review nullfs mount configs. Limit cross-jail socket access. Block untrusted processes from fd passing.

Secure Configuration

Prevent future escapes:

• Avoid nullfs mounts between sibling jails
• Disable Unix sockets across jails
• Restrict fd passing to privileged users
• Monitor jail process communication
• Audit shared mount configurations

FAQ