CVE-2026-101310
7.0HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-126, CWE-362, CWE-787
Impact
A malicious guest OS user can crash the host bhyve process or potentially execute code within the host userspace context. They only need access inside a guest VM that has the virtual HDA audio device configured.
Root cause
The bhyve HDA audio device model fails to validate zero-length Buffer Descriptor List (BDL) entries during DMA processing and is vulnerable to a TOCTOU race where the guest modifies BDL entries after validation.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the patch from FreeBSD security advisory FreeBSD-SA-26:72.bhyve.asc. As an interim workaround, remove HDA audio emulation (hda sound devices) from all bhyve VM configurations.
$ freebsd-update fetch && freebsd-update installAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.