vulnerabilities in the FreeBSD bhyve hypervisor

The FreeBSD community has addressed several vulnerabilities in the bhyve Hypervisor. These vulnerabilities involve race conditions, incorrect validation, and synchronization issues in various device models within the bhyve Hypervisor. A malicious guest virtual machine can exploit these errors to...

CVE-2026-101310

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

CVE-2026-101310 Multiple vulnerabilities in bhyve device models

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

CVE-2026-101310

The bhyve hypervisor contains a vulnerability in its HDA audio device model because it fails to validate zero-length Buffer Descriptor List (BDL) entries when starting a stream. This oversight, combined with the fact that BDL fields can be modified by a guest after validation, allows for an out-o...

EUVD-2026-101931

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

PT-2026-114821

Name of the Vulnerable Software and Affected Versions bhyve affected versions not specified Description The HDA audio device model fails to verify zero-length Buffer Descriptor List BDL entries when initiating a stream. This oversight leads to out-of-bounds read or write operations during Direct...

FreeBSD : FreeBSD -- Multiple vulnerabilities in bhyve device models (3f9e602e-c849-11f1-ada3-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3f9e602e-c849-11f1-ada3-bc241121aa0a advisory. Several vulnerabilities were found in the bhyve hypervisor's device models. The xHCI USB 3...

FreeBSD -- Multiple vulnerabilities in bhyve device models

Problem Description: Several vulnerabilities were found in the bhyve hypervisor's device models. The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded...

CVE-2023-53400

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names getlineoutpfx may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec. As a workaround, extend for t...

CVE-2025-38056 ASoC: SOF: Intel: hda: Fix UAF when reloading module

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix UAF when reloading module hdagenericmachineselect appends -idisp to the tplg filename by allocating a new string with devmkasprintf, then stores the string right back into the global variable...

CVE-2024-51564

A guest can trigger an infinite loop in the hda audio driver...

CVE-2024-51564

The bhyve hypervisor in FreeBSD contains a vulnerability in the hda audio driver where a guest can trigger an infinite loop . This flaw could allow a malicious guest virtual machine to perform a denial of service (DoS) against the bhyve host or potentially read restricted memory within the bhyve ...

CVE-2024-51564: Improper Validation of Specified Index, Position, or Offset in Input

A guest can trigger an infinite loop in the hda audio driver...

FreeBSD -- Multiple issues in the bhyve hypervisor

Problem Description: Several vulnerabilities were found in the bhyve hypervisor's device models. The NVMe driver function nvmeopcgetlogpage is vulnerable to a buffer over- read from a guest-controlled value. CVE-2024-51562 The virtiovqrecordon function is subject to a time-of-check to time-of-use...