Out-of-bounds write in FreeBSD - CVE-2026-101310
Published: October 14, 2026
Vulnerability identifier: #VU155792
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-101310
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
The vulnerability exists due to out-of-bounds reads or writes in the bhyve HDA audio device model when processing DMA transfers for streams containing zero-length buffer descriptor list entries. A local user can supply zero-length buffer descriptor list entries from a guest to crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine.
Exploitation requires the HDA device to be exposed to the guest. Host-side execution remains subject to bhyve's Capsicum sandbox.
Affected software
FreeBSD
How to mitigate CVE-2026-101310
Install security update from vendor's website.