CVE-2026-101308
CVE-2026-101308 · TOCTOU race between sound(4) buffer resizing and mmap
This page contains facts from public vulnerability sources. Check the original advisory before updating.
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.
CVSS 5.5 · Medium · EPSS 0.1%
- Published
- Updated
Affected products and versions
freebsd
- Versions
- ≥ 15.1-RELEASE, < p5: Affected (release)
- ≥ 14.5-RELEASE, < p2: Affected (release)
- ≥ 14.4-RELEASE, < p11: Affected (release)
No fix published