Out-of-bounds access in FreeBSD bhyve HDA audio device model
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
The bhyve hypervisor in FreeBSD is affected from 14.4-RELEASE before p11, from 14.5-RELEASE before p2, and from 15.1-RELEASE before p5. Its HDA audio device model does not check for zero-length Buffer Descriptor List entries when a stream starts, which causes out-of-bounds writes and reads during DMA transfers (CWE-787). A malicious guest can crash the bhyve process or potentially execute code in the host userspace, subject to the Capsicum sandbox.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | 15.1-RELEASE to before p5; 14.5-RELEASE to before p2; 14.4-RELEASE to before p11 | p5, p2, p11 | Patch available | CNA |
- FreeBSD VendorFreeBSD Affected 15.1-RELEASE to before p5; 14.5-RELEASE to before p2; 14.4-RELEASE to before p11 Fixed in p5, p2, p11 Patch available CNA
Remediation
Update FreeBSD to 14.4-RELEASE-p11, 14.5-RELEASE-p2, or 15.1-RELEASE-p5.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA FreeBSD (FreeBSD) Fixed in p5, p2, p11
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
FreeBSD — security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-74633 Race condition and missing validation in FreeBSD bhyve framebufferPriority LOW 32
- TI-2026-74631 Race condition in bhyve xHCI device model lets guests crash hostPriority LOW 32
Timeline
- 2026-10-15 Threatist record created from CVE-2026-101310
- 2026-10-16 Alias added: GHSA-gf8p-jhgw-8hg8
- 2026-10-16 CISA SSVC decision points changed
References
More FreeBSD vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-101310 · CVE Program
- CVE-2026-101310 · NVD
- FIRST EPSS
- GHSA-gf8p-jhgw-8hg8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences