FreeBSD jail/chroot escape via directory file descriptor exchange across sibling jails
CVE-2025-15576 is a FreeBSD jail subsystem flaw that can allow a jailed process to escape filesystem confinement (chroot-style restrictions) when directory file descriptors are exchanged between two sibling jails. In the vulnerable design, the kernel’s pathname lookup enforces jail-root containment by checking at each step whether traversal would descend below the current process’ jail root; if the jail root is not encountered, lookup continues. In a configuration where two sibling jails (with non-ancestor jail roots) share a directory via a nullfs mount and can communicate over a Unix domain socket, cooperating processes can pass directory descriptors. A process can receive a directory file descriptor that is outside/below its own jail root, and subsequent name lookups starting from that descriptor can bypass the jail-root containment checks, resulting in full filesystem access and effectively breaking jail/chroot isolation.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unknown (listed as a trending CVE affecting FreeBSD).
Unknown (listed as a trending CVE affecting FreeBSD; no technical details provided in the content).
A FreeBSD jail/chroot escape vulnerability involving file descriptor (fd) exchange between different jails, potentially allowing an attacker to break out of confinement.
A critical FreeBSD core jail subsystem vulnerability enabling a jail/chroot escape via directory file descriptor exchange across sibling jails (e.g., over a Unix domain socket) when sharing a directory via nullfs, resulting in loss of filesystem isolation and access to the host filesystem.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.