CVE-2026-101308
Undergoing Analysis Undergoing Analysis - In Progress

Buffer Overflow in FreeBSD Sound Driver

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: FreeBSD

Description
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-101308
EUVD
EUVD-2026-101883

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
FreeBSD FreeBSD 15.1-RELEASE
FreeBSD FreeBSD 14.5-RELEASE
FreeBSD FreeBSD 14.4-RELEASE

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a TOCTOU race condition in FreeBSD's sound(4) driver where an audio buffer resize operation fails to recheck if the buffer is memory-mapped after dropping a lock. An unprivileged local user can exploit this to trigger a kernel use-after-free, potentially escalating privileges.

Detection Guidance

This vulnerability is specific to FreeBSD systems with sound devices and cannot be directly detected via network scans. Check if your FreeBSD system has a sound device and is running an affected version. Use commands like 'uname -a' to verify the FreeBSD version and 'sysctl hw.snd' to confirm sound device presence.

Impact Analysis

An attacker with local access to a sound device could exploit this to crash the system or gain elevated privileges, including root access. Systems without sound devices are unaffected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to kernel-level privilege escalation in FreeBSD. However, if exploited, it could lead to unauthorized system access, potentially compromising data confidentiality and integrity, which are key requirements under GDPR and HIPAA. Organizations must ensure timely patching to maintain compliance.

Mitigation Strategies

Upgrade your FreeBSD system to a supported branch dated after October 14, 2026, using pkg(8), freebsd-update(8), or source patches. Reboot the system after applying updates. Systems without sound devices are unaffected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart