IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.5Mittel

CVE-2026-101308TOCTOU race between sound(4) buffer resizing and mmap

FreeBSD FreeBSD Veröffentlicht: (vor 22 Tagen)

Beschreibung

When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.

Schwachstellentyp (CWE): CWE-367

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
FreeBSD FreeBSD 15.1-RELEASE – < p5, 14.5-RELEASE – < p2, 14.4-RELEASE – < p11

Referenzen und Patches

CPE-Treffer (NVD) (18)
  • cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p10:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p8:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.4:p9:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.5:-:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:14.5:p1:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:15.1:p3:*:*:*:*:*:*
  • cpe:2.3:o:freebsd:freebsd:15.1:p4:*:*:*:*:*:*

Neue CVEs im selben Produkt — FreeBSD

7.0Hoch
CVE-2026-101311

Multiple vulnerabilities in bhyve device models

FreeBSD FreeBSD

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and th…

7.0Hoch
CVE-2026-101310

Multiple vulnerabilities in bhyve device models

FreeBSD FreeBSD

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by t…

7.0Hoch
CVE-2026-101309

Multiple vulnerabilities in bhyve device models

FreeBSD FreeBSD

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by th…

8.2Hoch
CVE-2026-101307

Remotely triggerable buffer overflow in tcp_rack

FreeBSD FreeBSD

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buff…

7.5Hoch
CVE-2026-101303

IPv6 UDP sendto(2) bypasses jail loopback restriction

FreeBSD FreeBSD

The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv…

6.5Mittel
CVE-2026-101302

Remote DoS via receive-side kernel TLS

FreeBSD FreeBSD

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an…