CVE-2026-53996
Received Received - Intake

Missing Access Control in NetBSD hdaudio(4) Driver Leads to Kernel Use-After-Free

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description
NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from a second thread to trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), where a latched DMA interrupt dereferences a freed callback pointer, resulting in outcomes ranging from audio-subsystem denial of service and kernel panic to potential local kernel privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-53996
EUVD
EUVD-2026-57210

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netbsd netbsd to 11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53996 is a missing access control flaw in NetBSD's hdaudio(4) driver. It allows unprivileged local users to execute the HDAUDIO_FGRP_SETCONFIG ioctl command without elevated permissions due to improper checks on /dev/hdaudioN device nodes. This can trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), leading to potential kernel panic, denial of service, or privilege escalation.

Detection Guidance

To detect this vulnerability, check if unprivileged users can access /dev/hdaudioN device nodes with write permissions. Use 'ls -l /dev/hdaudio*' to verify permissions. If any node allows read-only access to unprivileged users, the system may be vulnerable.

Impact Analysis

An attacker could exploit this to cause system instability like kernel panics or audio subsystem crashes. In severe cases, it may allow local privilege escalation, enabling an attacker to gain higher system access. The vulnerability is triggered by manipulating ioctl commands and race conditions in the hdaudio driver.

Mitigation Strategies

Apply the official NetBSD patches for CVE-2026-53996 to add access checks to the ioctl routines in hdaudio.c. Ensure only users with write permissions on /dev/hdaudioN can execute the HDAUDIO_FGRP_SETCONFIG command. Update to a patched NetBSD version (netbsd-9, netbsd-10, or netbsd-11).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart