Buffer Overflow in Audio Device Driver Affects FreeBSD

CVE-2026-45258

What is CVE-2026-45258?

A vulnerability in the FreeBSD audio device driver allows for the possibility of a buffer overflow due to improper validation of user-supplied input. Specifically, the function dsp_mmap_single() fails to adequately check the sum of the user-supplied offset and length against the buffer size, which can lead to an overflow situation. An attacker could exploit this oversight by providing a large offset and length, resulting in memory mappings that extend beyond the audio buffer. Since the /dev/dsp device nodes are accessible to all users by default, this vulnerability presents a significant risk, allowing an unprivileged local user to both read and write to kernel memory. Consequently, this could lead to privilege escalation or even a Denial of Service (DoS), where the attacker might crash the kernel, severely impacting system stability.

References