-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-26:72.bhyve Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in bhyve device models
Category: core
Module: bhyve
Announced: 2026-10-14
Credits: Brian Delgado from Intel using Anthropic Opus 4.8
Credits: Claude and Ada Logics
Credits: Joshua Rogers of AISLE Research Team
Credits: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Affects: All supported versions of FreeBSD.
Corrected: 2026-10-14 16:03:00 UTC (stable/15, 15.1-STABLE)
2026-10-14 16:04:40 UTC (releng/15.1, 15.1-RELEASE-p5)
2026-10-14 16:03:16 UTC (stable/14, 14.5-STABLE)
2026-10-14 16:04:14 UTC (releng/14.5, 14.5-RELEASE-p2)
2026-10-14 16:03:57 UTC (releng/14.4, 14.4-RELEASE-p11)
CVE Name: CVE-2026-101309, CVE-2026-101310, CVE-2026-101311
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
bhyve(8) is a hypervisor that runs guest operating systems inside a
virtual machine.
II. Problem Description
Several vulnerabilities were found in the bhyve hypervisor's device
models.
The xHCI (USB 3) device model did not validate or save the event ring
size provided by the guest. The size was re-read from guest memory on
each use, and Transfer Request Block (TRB) fields were loaded without
protection against concurrent modification by the guest. This race
condition could be triggered by a guest running malicious, privileged
code. (CVE-2026-101309)
The HDA audio device model did not check for zero-length Buffer
Descriptor List (BDL) entries when starting a stream. A zero-length
entry caused an out-of-bounds read or write during DMA transfer
processing. BDL fields were also subject to modification by the
guest after validation. (CVE-2026-101310)
The framebuffer device model's maximum resolution constants were
duplicated between the framebuffer and RFB modules and had gotten out
of sync. Additionally, writes to the framebuffer BAR could set
arbitrary width and height values without validation, and the
framebuffer BAR I/O and RFB rendering threads were not synchronized.
(CVE-2026-101311)
III. Impact
A malicious guest can crash the bhyve process or potentially
execute arbitrary code in the host userspace context running the
virtual machine, subject to bhyve's Capsicum sandbox.
IV. Workaround
No workaround is available. Virtual machines that provide none of
the "xhci", "hda", and "fbuf" devices to guests are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Restart all bhyve virtual machines, or reboot the system.
Perform one of the following:
1) To update your vulnerable system installed from base system packages:
Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:
# pkg upgrade -r FreeBSD-base
2) To update your vulnerable system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 15.x]
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-15.patch
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-15.patch.asc
# gpg --verify bhyve-15.patch.asc
[FreeBSD 14.x]
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-14.patch
# fetch https://security.FreeBSD.org/patches/SA-26:72/bhyve-14.patch.asc
# gpg --verify bhyve-14.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch -E -p0 < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in .
Restart all bhyve virtual machines, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ 07c15b75ff78 stable/15-n286008
releng/15.1/ febb02e3253c releng/15.1-n283638
stable/14/ fa7fe70671ee stable/14-n275355
releng/14.5/ 2e4ec07874a2 releng/14.5-n274893
releng/14.4/ 00ec12d48c63 releng/14.4-n273788
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat
Or visit the following URL, replacing NNNNNN with the hash:
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmrPwd8bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv2bwP/0+lymnNlkfbBG77FAa2
oaF/qeH2BOZ6ObCykMgevVuidI6NJQmaXrYfM3IaTla3+poi9UrInEz0ppGRpmar
SJurTHSKfFMfs3javxDgbOl8bR5Sghi60wFkX0alhZmtQYms5nle+qBFf2rFyGSY
I32W6wR+tTjH/Fp5kyqc/3j+CDrfnl2KFUJodu6gZbWIprPcoU+vIWVP3NH9hc68
RAOAyKXzgufOV+lyxyDbL8tCTO50W4sMvMeMxSguaffbfn/x0aG2Y6ohONAWdY0W
6rGrtDhqojg/zXWbau5tqFBLUy+Z+k7cCatr2TBGdHujvxTiQ7qV3taJGXol66yN
K6PHRZzgYMcBE9eqjqxYMEr9pQyXHNLNspGnZxZVMSj/t4dD11MGV7GiG3jOL8Wz
GBQIxE0ePvMYLudZPjsfrPmbAPTt1+KDq0ML/l7jFwGuDEbcsNum5IKtIGpkVmO3
ehrfIF8USvvsPrszviJ1bSorZsmAGoO1hO4JvvyxnO1WbMW+6TFV3KBl3Vuo3gVR
gD9KRuM2aV3r4C5hRxTAx7386ryP6f0tR16JQo97O4pnFXz6SyNluWxdmf/3hkgo
gOq9QCVxtBPL3k5TrCkz8dTpODz6Ji81NDLAADtK2M4+IPHV/5xMpLgXnfU9t/eV
kCHlcMVuNaS38EzrcYtCWqQN
=bQls
-----END PGP SIGNATURE-----