Race Condition in xHCI Device Model of bhyve by FreeBSD
CVE-2026-101309

Currently unrated

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
15 October 2026

What is CVE-2026-101309?

A vulnerability exists in the xHCI (USB 3) device model of FreeBSD's bhyve virtualization software due to inadequate validation of the event ring size specified by a guest. As the size can be re-read from guest memory during each operation, this flaw creates a potential race condition, allowing a privileged guest to manipulate Transfer Request Block (TRB) fields concurrently. Exploitation of this vulnerability could lead to a crash of the bhyve process or even facilitate the execution of arbitrary code within the host userspace context, although it remains constrained by the Capsicum sandboxing mechanism.

Affected Version(s)

FreeBSD 15.1-RELEASE

FreeBSD 14.5-RELEASE

FreeBSD 14.4-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:72....
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Delgado from Intel using Anthropic Opus 4.8
Joshua Rogers of AISLE Research Team
Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
.