CVE-2026-101311

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in FreeBSD bhyve Framebuffer

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101311

EUVD

EUVD-2026-101930

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE
FreeBSD	FreeBSD	14.5-RELEASE
FreeBSD	FreeBSD	14.4-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability involves a synchronization issue in the FreeBSD bhyve hypervisor's framebuffer device model. The maximum resolution constants were duplicated and became inconsistent between the framebuffer and RFB modules. Additionally, the framebuffer BAR allowed arbitrary width and height values without validation, and threads handling framebuffer BAR I/O and RFB rendering were not synchronized.

Detection Guidance

This vulnerability is specific to the FreeBSD bhyve hypervisor and requires access to the host system for detection. Check if your FreeBSD system is running a vulnerable version of bhyve by reviewing installed versions and comparing them against FreeBSD's security advisory. Monitor bhyve process logs for crashes or unusual behavior during guest VM operations.

Impact Analysis

A malicious guest operating system could exploit this flaw to crash the bhyve process or potentially execute arbitrary code in the host userspace context where the virtual machine is running. The impact is limited by bhyve's Capsicum sandbox, which restricts the scope of potential damage.

Compliance Impact

This vulnerability allows a malicious guest to execute arbitrary code in the host userspace context, which could lead to unauthorized data access, modification, or exfiltration. This poses significant risks to compliance with GDPR (data protection) and HIPAA (health data privacy) by potentially violating confidentiality and integrity requirements.

Mitigation Strategies

Apply the patch provided in FreeBSD-SA-26:72.bhyve.asc to synchronize framebuffer and RFB module constants and validate framebuffer BAR writes. Restart affected bhyve virtual machines after patching.

Hi! I’m here to help you understand CVE-2026-101311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70