{"api_version":"1","generated_at":"2026-08-19T11:44:40+00:00","cve":"CVE-2026-49419","urls":{"html":"https://cve.report/CVE-2026-49419","api":"https://cve.report/api/cve/CVE-2026-49419.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-49419","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-49419"},"summary":{"title":"Jail reference count underflow","description":"When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor.  If the descriptor lookup failed, error-handling paths released the same reference a second time.\n\nAn unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use.  When this is done on the jail host, the bug will generally result in an immediate panic.  However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.","state":"PUBLISHED","assigner":"freebsd","published_at":"2026-08-19 05:17:04","updated_at":"2026-08-19 05:17:04"},"problem_types":["CWE-911","CWE-911 CWE-911: Improper Update of Reference Count"],"metrics":[],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.asc","name":"https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.asc","refsource":"secteam@freebsd.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49419","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49419","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.1-RELEASE p1 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.0-RELEASE p11 release","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","modules":["jail"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p1","status":"affected","version":"15.1-RELEASE","versionType":"release"},{"lessThan":"p11","status":"affected","version":"15.0-RELEASE","versionType":"release"}]}],"credits":[{"lang":"en","type":"finder","value":"Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai"}],"datePublic":"2026-06-30T20:00:00.000Z","descriptions":[{"lang":"en","value":"When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor.  If the descriptor lookup failed, error-handling paths released the same reference a second time.\n\nAn unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use.  When this is done on the jail host, the bug will generally result in an immediate panic.  However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-911","description":"CWE-911: Improper Update of Reference Count","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-19T04:32:39.446Z","orgId":"63664ac6-956c-4cba-a5d0-f46076e16109","shortName":"freebsd"},"references":[{"tags":["vendor-advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:38.jail.asc"}],"title":"Jail reference count underflow","x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"63664ac6-956c-4cba-a5d0-f46076e16109","assignerShortName":"freebsd","cveId":"CVE-2026-49419","datePublished":"2026-08-19T04:32:39.446Z","dateReserved":"2026-05-29T20:24:28.616Z","dateUpdated":"2026-08-19T04:32:39.446Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-19 05:17:04","lastModifiedDate":"2026-08-19 05:17:04","problem_types":["CWE-911","CWE-911 CWE-911: Improper Update of Reference Count"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"49419","Ordinal":"1","Title":"Jail reference count underflow","CVE":"CVE-2026-49419","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"49419","Ordinal":"1","NoteData":"When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor.  If the descriptor lookup failed, error-handling paths released the same reference a second time.\n\nAn unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use.  When this is done on the jail host, the bug will generally result in an immediate panic.  However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.","Type":"Description","Title":"Jail reference count underflow"}]}}}