CVE-2026-101309
7.0HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-362
Impact
A privileged attacker inside a guest VM can escape to execute arbitrary code in the host's bhyve userspace context or crash the bhyve process. Exploitation requires local privileged execution within the guest.
Root cause
The xHCI device model repeatedly re-reads the event ring size and TRB fields from shared guest memory without validation or concurrency protection, causing a race condition.
Affected systems
FreeBSD bhyve; exact affected version numbers not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the patch from FreeBSD-SA-26:72.bhyve.asc. As an interim workaround, remove xHCI (USB 3) device emulation from guest VM configurations.
$ freebsd-update fetch && freebsd-update installAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.