CVE-2026-101310: Multiple vulnerabilities in bhyve device models
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation.
A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hosts running FreeBSD bhyve virtual machines that use the HDA audio device model are exposed. The malicious actor is a guest operating system, so this is primarily a guest-to-host isolation risk.
What does an attacker need to exploit it?
An attacker needs the ability to run or control a guest on the affected bhyve host and provide malicious HDA Buffer Descriptor List entries. The issue involves zero-length entries and guest modification of BDL fields after validation.
What is the potential impact on the host?
A malicious guest can crash the bhyve process. It may also potentially execute arbitrary code in the host userspace context that runs the virtual machine, subject to bhyve's Capsicum sandbox.