CVE-2026-101308
CVE-2026-101308 · TOCTOU race between sound(4) buffer resizing and mmap
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.
CVSS 5.5 · Media · EPSS 0,1%
- Publicación
- Actualización
Productos y versiones afectados
freebsd
- Versiones
- ≥ 15.1-RELEASE, < p5: Afectada (release)
- ≥ 14.5-RELEASE, < p2: Afectada (release)
- ≥ 14.4-RELEASE, < p11: Afectada (release)
Sin corrección publicada