FreeBSD: unlinkat AT_RESOLVE_BENEATH flag dropped, path containment bypass
CVE-2026-49421 Published on August 19, 2026
unlinkat(2) ignores AT_RESOLVE_BENEATH flag
The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted.
A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree.
Weakness Type
Improper Check for Dropped Privileges
The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. If the drop fails, the software will continue to run with the raised privileges, which might provide additional access to unprivileged users.
Products Associated with CVE-2026-49421
Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.
Affected Versions
FreeBSD:- Version 15.1-RELEASE and below p1 is affected.
- Version 15.0-RELEASE and below p11 is affected.
- Version 14.4-RELEASE and below p7 is affected.
- Version 14.3-RELEASE and below p16 is affected.