Race condition in bhyve xHCI device model lets guests crash host
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
FreeBSD from 15.1-RELEASE before p5, from 14.5-RELEASE before p2, and from 14.4-RELEASE before p11 are affected. The bhyve xHCI USB device model re-reads the event ring size from guest memory and loads Transfer Request Block fields without protection against concurrent guest modification, a race condition (CWE-362). A guest running malicious privileged code can crash the bhyve process or potentially execute code in the host userspace, subject to the Capsicum sandbox.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | 15.1-RELEASE to before p5; 14.5-RELEASE to before p2; 14.4-RELEASE to before p11 | p5, p2, p11 | Patch available | CNA |
- FreeBSD VendorFreeBSD Affected 15.1-RELEASE to before p5; 14.5-RELEASE to before p2; 14.4-RELEASE to before p11 Fixed in p5, p2, p11 Patch available CNA
Remediation
Apply the fixes FreeBSD 15.1-RELEASE p5, 14.5-RELEASE p2, or 14.4-RELEASE p11 for the affected release branch.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA FreeBSD (FreeBSD) Fixed in p5, p2, p11
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
FreeBSD — security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-74633 Race condition and missing validation in FreeBSD bhyve framebufferPriority LOW 32
- TI-2026-74632 Out-of-bounds access in FreeBSD bhyve HDA audio device modelPriority LOW 32
Timeline
- 2026-10-15 Threatist record created from CVE-2026-101309
- 2026-10-16 Alias added: GHSA-6jf6-r4g2-3vh5
- 2026-10-16 CISA SSVC decision points changed
References
More FreeBSD vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-101309 · CVE Program
- CVE-2026-101309 · NVD
- FIRST EPSS
- GHSA-6jf6-r4g2-3vh5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences