Description
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation.
A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Metrics
CVSS 3.1 7.0/10
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| FreeBSD | FreeBSD | >= 15.1-RELEASE, < p5; >= 14.5-RELEASE, < p2; >= 14.4-RELEASE, < p11 |
References
Timeline
- Published
- Oct 15, 2026
- Last modified
- Oct 16, 2026
- NVD status
- Awaiting Analysis