CVE-2026-101308
CVE-2026-101308 · TOCTOU race between sound(4) buffer resizing and mmap
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.
CVSS 5.5 · Mittel · EPSS 0,1%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
freebsd
- Softwareversionen
- ≥ 15.1-RELEASE, < p5: Betroffen (release)
- ≥ 14.5-RELEASE, < p2: Betroffen (release)
- ≥ 14.4-RELEASE, < p11: Betroffen (release)
Keine Korrektur veröffentlicht