Use-After-Free Vulnerability in FreeBSD Sound Driver

CVE-2026-101308

What is CVE-2026-101308?

This vulnerability relates to improper handling of memory operations within the FreeBSD sound driver. When resizing an audio channel's buffer, the driver drops the channel lock, opening a window for a concurrent thread to exploit the situation. If an unprivileged local user gains access to a sound device, they could leverage this flaw to perform a mmap(2) operation, leading to a use-after-free condition. This flaw could allow for unauthorized privilege escalation, posing significant security risks to affected systems.

References