CVE-2026-101308: FreeBSD sound(4) use-after-free in buffer resize TOCTOU race

CVE-2026-101308 · Severity: medium · CVSS 5.5 · Published 2026-10-15

FreeBSD's sound(4) driver manages audio device buffers that applications can memory-map for low-latency audio I/O. A race condition exists between buffer resizing and memory mapping that allows an unprivileged local user with sound device access to free a buffer that has been mapped by another thread, causing a use-after-free and potential privilege escalation.

Technologies: Freebsd. Vendors: Freebsd.

Quick answers

Is CVE-2026-101308 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-101308 being exploited in the wild.
How severe is CVE-2026-101308?
Medium severity, with a CVSS score of 5.5, published 15 October 2026.
Which products and versions are affected?
Freebsd all supported versions; patched in 15.1-RELEASE-p5, 14.5-RELEASE-p2, 14.4-RELEASE-p11, and stable branches.
Is there a fix for CVE-2026-101308?
Yes: fixed in FreeBSD 15.1-RELEASE-p5, 14.5-RELEASE-p2, 14.4-RELEASE-p11 and later. Until then: No workaround is available. Systems without sound devices are unaffected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101308 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-101308?
Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: FreeBSD 15.1-RELEASE-p5, 14.5-RELEASE-p2, 14.4-RELEASE-p11 and later

No workaround is available. Systems without sound devices are unaffected.

Technical details

The sound(4) driver checks if a buffer is memory-mapped before resizing, but drops the channel lock during new buffer allocation, creating a time-of-check-time-of-use (TOCTOU) window. During this window, another thread can successfully mmap the buffer, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local attacker with access to /dev/dsp or similar audio device nodes can trigger this use-after-free to gain kernel code execution and escalate privileges.

Affected products

  • FreeBSD FreeBSD all supported versions; patched in 15.1-RELEASE-p5, 14.5-RELEASE-p2, 14.4-RELEASE-p11, and stable branches

Timeline

  • 2026-10-14: disclosed: Security advisory announced
  • 2026-10-14: patched: Patches applied to stable/15, stable/14, and release branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.