CVE-2026-101311

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101311

The bhyve hypervisor contains multiple vulnerabilities in its device models, specifically affecting the framebuffer device model. The issue stems from duplicated and desynchronized maximum resolution constants between the framebuffer and RFB modules. Additionally, the framebuffer BAR allows write...

EUVD-2026-101930

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101309

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

EUVD-2026-101932

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309: Concurrent Execution using Shared Resource with Improper Synchronization

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101310: Buffer Over-read

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

FreeBSD Security Advisory - FreeBSD-SA-26:72.bhyve

FreeBSD Security Advisory - Multiple vulnerabilities in bhyve device models. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox...

CVE-2026-45259 sigqueue(2) missing capability mode restriction

sigqueue2 was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kernsigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capability mode can use sigqueue2 to send signa...

FreeBSD : FreeBSD -- sigqueue(2) missing capability mode restriction (94f20492-6473-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 94f20492-6473-11f1-958d-bc241121aa0a advisory. sigqueue2 was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the...

FreeBSD -- sigqueue(2) missing capability mode restriction

Problem Description: sigqueue2 was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kernsigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. Impact: A process in capability mode ca...

CVE-2020-7461

In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient8 fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle ...

EUVD-2023-44153

Malicious code in bioql PyPI...

FreeBSD : FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation (1febd09b-7716-11ef-9a62-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1febd09b-7716-11ef-9a62-002590c1f29c advisory. bhyve can be configured to emulate devices on a virtual USB controller XHCI, such as USB tablet devices...

FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation

Problem Description: bhyve can be configured to emulate devices on a virtual USB controller XHCI, such as USB tablet devices. An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code...

FreeBSD : FreeBSD -- umtx Kernel panic or Use-After-Free (7e079ce2-6b51-11ef-9a62-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7e079ce2-6b51-11ef-9a62-002590c1f29c advisory. Concurrent removals of such a mapping by using the UMTXSHMDESTROY sub-request of UMTXOPSHM can lead to...

FreeBSD : FreeBSD -- bhyve(8) privileged guest escape via USB controller (4edaa9f4-6b51-11ef-9a62-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4edaa9f4-6b51-11ef-9a62-002590c1f29c advisory. bhyve can be configured to emulate devices on a virtual USB controller XHCI, such as USB tablet devices...

CVE-2024-32668

An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privileged software running in a guest VM can exploit the vulnerability to achieve code execution on the host in the bhyve userspace process, whic...

CVE-2024-42416

The ctlreportsupportedopcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on...

CVE-2024-43110

The ctlrequestsense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note th...