CVE-2026-101311: Multiple vulnerabilities in bhyve device models
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.
A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hosts running FreeBSD bhyve with the affected framebuffer and RFB device-model functionality are exposed. Exploitation is performed by a malicious guest and targets the host userspace process running that virtual machine.
What access does an attacker need?
An attacker needs the ability to run or control a guest on the affected bhyve host. The issue involves guest writes to the framebuffer BAR and races with the RFB rendering thread.
What is the potential impact on the host?
A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context of the virtual machine. Any resulting code execution is subject to bhyve's Capsicum sandbox.