CVE-2025-15547 - CVE House
Back to Database
Status published Unknown CVE-2025-15547

Jail escape by a privileged user via nullfs

Vulnerability Description

By default, jailed processes cannot mount filesystems, including nullfs(4). However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic allows that user to escape the jail's chroot, yielding access to the full filesystem of the host or parent jail. In a jail configured to allow nullfs(4) mounts from within the jail, the jailed root user can escape the jail's filesystem root.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15547

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreeBSD

View All →
CVE-2025-24934
SO_REUSEPORT_LB breaks connect(2) for UDP sockets
Unknown 0
CVE-2025-15576
Jail chroot escape via fd exchange with a different jail
Unknown 0
CVE-2025-14769
ipfw denial of service
Unknown 0
CVE-2025-14558
Remote code execution via ND6 Router Advertisements
Unknown 0
CVE-2025-0662
Uninitialized kernel memory disclosure via ktrace(2)
Unknown 0

Affected Vendor

Affected Software

FreeBSD
Vulnerable Versions:
14.3-RELEASE, 13.5-RELEASE

Timeline

Official Publish: March 9th, 2026
Last Modified: March 10th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion