Vulnerability in FreeBSD

[ Description ]Official description

When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.

[ Fixes ]Fixes and patches

• Patch on security.freebsd.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0452

  Vulnerabilities fixed in FreeBSD bhyve hypervisor Translated from Dutch

  Probability/damage M/HCVE-2026-101307CVE-2026-101308CVE-2026-101309+2 more CVEs
• BSI CERT-Bund14 Oct 2026WID-SEC-2026-3967

  FreeBSD Project FreeBSD OS: Multiple vulnerabilities Translated from German

  CVE-2026-101311CVE-2026-101307CVE-2026-101308+2 more CVEs

[ References ]References

• security.freebsd.org/advisories/FreeBSD-SA-26:71.sound.ascPatchVendor Advisory