CVE-2026-101306
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restric
CVSS
9.8
Crítica
EPSS
0.3%
p19
KEV
—
Exploit Today
6
0-100
Publicado: 15 de out. de 2026 · Última mod.: 20 de out. de 2026 · CWE-273 · CWE-281
0.2%EPSS · 30 dias0.3%
2026-10-152026-11-05
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-48183—2.8%
——1Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions1dCVE-2026-863858.8 ALT31.2%
——9Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.8dCVE-2025-101498.2 ALT7.4%
——2The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.
A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.2dCVE-2026-1013058.8 ALT14.2%
——4renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.18dCVE-2026-1013047.1 ALT3.9%
——1When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.
A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.17dCVE-2026-475997.8 ALT1.3%
——0NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause improper preservation of memory access permissions during DMA mapping. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.36d