CVE-2026-101310

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVSS 3.1

7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-25)

CWEs

CWE-126, CWE-362, CWE-787

Published

2026-10-15

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc

Check your stackJSON