CVE-2026-101309

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in bhyve xHCI Device Model

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101309

EUVD

EUVD-2026-101932

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE
FreeBSD	FreeBSD	14.5-RELEASE
FreeBSD	FreeBSD	14.4-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

CVE-2026-101309 is a race condition in the FreeBSD bhyve hypervisor's xHCI (USB 3) device model. The vulnerability occurs because the event ring size provided by a guest VM is not validated or saved properly. Instead, it is repeatedly read from guest memory, and Transfer Request Block fields are loaded without protection against concurrent modification by the guest. This allows a malicious guest running privileged code to exploit the flaw.

The issue can lead to crashes of the bhyve process or potentially allow arbitrary code execution in the host userspace context where the virtual machine runs. However, the impact is limited by bhyve's Capsicum sandbox, which restricts the scope of potential damage.

Detection Guidance

Detecting this vulnerability requires checking if your FreeBSD system is running a vulnerable version of bhyve with the xHCI device model. Check the FreeBSD version and installed bhyve components using 'freebsd-version' and 'pkg info bhyve'. Monitor logs for crashes in the bhyve process or unusual guest activity.

Impact Analysis

If you are running a FreeBSD system with the bhyve hypervisor and a guest VM with malicious privileged code, this vulnerability could allow the guest to crash the bhyve process or execute arbitrary code on the host system. This could disrupt services or compromise the host environment, though the sandbox limits the extent of the damage.

Compliance Impact

This vulnerability primarily impacts system integrity and availability rather than directly violating compliance standards like GDPR or HIPAA. However, it could lead to unauthorized code execution in host userspace, potentially compromising data confidentiality or integrity if exploited. Compliance may be indirectly affected if the vulnerability enables data breaches or disrupts critical services.

Mitigation Strategies

Apply the patch provided by FreeBSD immediately. Update your system using 'freebsd-update fetch install' or 'pkg update && pkg upgrade'. If patching is not immediately possible, disable the xHCI device model in bhyve configurations or restrict guest access to privileged code until the patch is applied.

Hi! I’m here to help you understand CVE-2026-101309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70