CVE-2026-101310

Awaiting Analysis Awaiting Analysis - Queue

Buffer Descriptor List Out-of-Bounds Access in bhyve

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101310

EUVD

EUVD-2026-101931

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE
FreeBSD	FreeBSD	14.5-RELEASE
FreeBSD	FreeBSD	14.4-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves the HDA audio device model in the FreeBSD bhyve hypervisor. It fails to validate zero-length Buffer Descriptor List (BDL) entries when starting an audio stream. This oversight leads to out-of-bounds memory access during DMA transfers. Additionally, guest users can modify BDL fields after validation, enabling further exploitation.

Detection Guidance

This vulnerability is specific to the FreeBSD bhyve hypervisor's HDA audio device model and requires access to the virtual machine's configuration and logs. Detection involves checking for crashes in the bhyve process or unusual DMA transfer errors. Review bhyve logs for out-of-bounds read/write errors during audio stream processing. Ensure the bhyve process is running with Capsicum sandboxing enabled as a mitigation measure.

Impact Analysis

A malicious guest operating system could crash the bhyve process or execute arbitrary code within the host's userspace context. However, the impact is limited by bhyve's Capsicum sandbox, which restricts the scope of potential damage.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a technical flaw in the FreeBSD bhyve hypervisor's HDA audio device model. Compliance impacts would depend on how the vulnerability is exploited in a specific environment, such as unauthorized access or data exfiltration, which are not detailed in the provided context.

Mitigation Strategies

Apply the patch released by FreeBSD for the bhyve hypervisor to address the BDL validation issue. Ensure the bhyve process is running with the Capsicum sandbox enabled to limit potential impact. Monitor for crashes in the bhyve process as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-101310. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70