Race condition and missing validation in FreeBSD bhyve framebuffer
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
FreeBSD bhyve device models contain flaws in the framebuffer device, where maximum resolution constants are duplicated between the framebuffer and RFB modules and have fallen out of sync. Writes to the framebuffer BAR can set width and height values without validation, and the BAR I/O and RFB rendering threads are not synchronized, which is a race condition (CWE-362). A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | 15.1-RELEASE to before p5; 14.5-RELEASE to before p2; 14.4-RELEASE to before p11 | p5, p2, p11 | Patch available | CNA |
- FreeBSD VendorFreeBSD Affected 15.1-RELEASE to before p5; 14.5-RELEASE to before p2; 14.4-RELEASE to before p11 Fixed in p5, p2, p11 Patch available CNA
Remediation
Upgrade FreeBSD 15.1-RELEASE to p5, FreeBSD 14.5-RELEASE to p2, or FreeBSD 14.4-RELEASE to p11 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA FreeBSD (FreeBSD) Fixed in p5, p2, p11
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
FreeBSD — security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-74632 Out-of-bounds access in FreeBSD bhyve HDA audio device modelPriority LOW 32
- TI-2026-74631 Race condition in bhyve xHCI device model lets guests crash hostPriority LOW 32
Timeline
- 2026-10-15 Threatist record created from CVE-2026-101311
- 2026-10-16 Alias added: GHSA-gxmh-c4q6-pg9m
- 2026-10-16 CISA SSVC decision points changed
References
More FreeBSD vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-101311 · CVE Program
- CVE-2026-101311 · NVD
- FIRST EPSS
- GHSA-gxmh-c4q6-pg9m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences