Executive brief
A security vulnerability has been identified in the FreeBSD audio driver, which manages sound hardware on the system. An attacker with basic access to the computer can exploit this flaw to read or write to restricted system memory. This could allow them to take full control of the system, access sensitive data, or cause a complete system crash.
Technical details
A use-after-free vulnerability exists in the FreeBSD sound(4) driver's mmap(2) implementation. When an audio device node (e.g., /dev/dsp) is closed, the underlying audio buffer backing a memory mapping may be freed even if the mapping remains valid in the process's address space. Because /dev/dsp is world-accessible by default, a local unprivileged attacker can trigger this condition to access freed memory that may be reused by other kernel processes. This allows for arbitrary read/write access to kernel memory, leading to local privilege escalation or a kernel panic (DoS). The issue is resolved in FreeBSD 15.0-RELEASE-p10, 14.4-RELEASE-p6, and 14.3-RELEASE-p15.
Affected products
- FreeBSD FreeBSD 15.0-RELEASE before p10, 14.4-RELEASE before p6, 14.3-RELEASE before p15
Timeline
- 2026-06-09: patched: Fixes committed to FreeBSD stable and release branches.
- 2026-06-09: advisory: FreeBSD Project released advisory FreeBSD-SA-26:27.sound.asc.
- 2026-06-27: disclosed: CVE published in the NVD.