What’s Vulnerable › Vulnerabilities
CVE-2026-101309: Multiple vulnerabilities in bhyve device models
- Severity: high (CVSS 7.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-15 · updated 2026-10-16
- Weakness: CWE-362
Description
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Affected products
- FreeBSD: from 15.1-RELEASE before p5; from 14.5-RELEASE before p2; from 14.4-RELEASE before p11 — fixed in p11, p2, p5
How to fix
Upgrade to a fixed version: FreeBSD p11, p2, p5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-101309 or the next vulnerability affects your stack