CVE-2026-49421

Name of the Vulnerable Software and Affected Versions FreeBSD kernel (affected versions not specified)

Description The kernel functions implementing unlinkat(2) and funlinkat(2) fail to pass the AT RESOLVE BENEATH flag to the underlying path lookup process. Although the flag is validated, it is silently dropped, meaning path resolution is not restricted as intended. Consequently, a process attempting to confine path resolution using this flag can resolve paths above the starting directory, potentially allowing the deletion of files outside the intended directory tree, which impacts the integrity of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.