CVE-2026-101309: Multiple vulnerabilities in bhyve device models
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code.
A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hosts running FreeBSD bhyve with the xHCI (USB 3) device model are exposed. Exploitation requires a guest running malicious privileged code.
What could a successful exploit do?
A malicious guest may crash the bhyve process. It may also potentially execute arbitrary code in the host userspace context that runs the virtual machine, subject to bhyve's Capsicum sandbox.
Is host-level access required for exploitation?
The described trigger originates from privileged code inside the guest. The issue is caused by guest-controlled event ring size and TRB fields being re-read or concurrently modified by the guest.