Race condition in FreeBSD - CVE-2026-101309
Published: October 14, 2026
Vulnerability details
The vulnerability allows a local user to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
The vulnerability exists due to a race condition and insufficient validation of guest-controlled event ring data in the bhyve xHCI device model when processing event ring sizes and transfer request block fields from guest memory. A local user can run malicious privileged code in a guest to modify these values concurrently with their use to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
Exploitation requires the xHCI device to be exposed to the guest. Host-side execution remains subject to bhyve's Capsicum sandbox.