CVE-2026-58091 Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

CVE-2026-58091

The FreeBSD kernel contains a use-after-free vulnerability in the sound module caused by the SNDCTL_DSP_SYNCSTART ioctl. When attempting to acquire locks on all channels in a sync group, the implementation releases the sync group list lock and sleeps if a channel would block; however, it fails to...

CVE-2026-58091 Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

FreeBSD : FreeBSD -- Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl (226751fb-a0fe-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 226751fb-a0fe-11f1-ae1f-bc241121aa0a advisory. The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking ...

FreeBSD-SA-26:58.sound

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:58.sound Security Advisory The FreeBSD Project Topic: Kernel use-after-free via the SNDCTLDSPSYNCSTART ioctl Category: core Module: sound Announced:...