SB2026101493 - Multiple vulnerabilities in FreeBSD bhyve device models
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Race condition (CVE-ID: CVE-2026-101309)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
The vulnerability exists due to a race condition and insufficient validation of guest-controlled event ring data in the bhyve xHCI device model when processing event ring sizes and transfer request block fields from guest memory. A local user can run malicious privileged code in a guest to modify these values concurrently with their use to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
Exploitation requires the xHCI device to be exposed to the guest. Host-side execution remains subject to bhyve's Capsicum sandbox.
2) Out-of-bounds write (CVE-ID: CVE-2026-101310)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
The vulnerability exists due to out-of-bounds reads or writes in the bhyve HDA audio device model when processing DMA transfers for streams containing zero-length buffer descriptor list entries. A local user can supply zero-length buffer descriptor list entries from a guest to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
Exploitation requires the HDA device to be exposed to the guest. Host-side execution remains subject to bhyve's Capsicum sandbox.
3) Input validation error (CVE-ID: CVE-2026-101311)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
The vulnerability exists due to improper validation of framebuffer dimensions, inconsistent maximum resolution constants, and unsynchronized framebuffer access in the bhyve framebuffer and RFB modules when handling framebuffer BAR writes and rendering framebuffer content. A local user can write arbitrary width and height values to the framebuffer BAR from a guest to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
Exploitation requires the framebuffer device to be exposed to the guest. Host-side execution remains subject to bhyve's Capsicum sandbox.
Remediation
Install update from vendor's website.