CVE-2026-101308: TOCTOU race between sound(4) buffer resizing and mmap
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.
An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the FreeBSD sound(4) driver are exposed when an unprivileged local user has access to a sound device. The issue requires local access; no remote attack vector is described.
What does an attacker need to do to exploit it?
An attacker needs to race audio-buffer resizing against mmap(2) from another thread. If mmap(2) completes after the resize path checks mapping status but before it frees the old buffer, the kernel can use a freed mapped buffer.
What is the likely impact of successful exploitation?
Successful exploitation can trigger a kernel use-after-free. The described potential impact is local privilege escalation.