Access Control Vulnerability in NetBSD's HDAudio Driver

CVE-2026-53996

What is CVE-2026-53996?

The hdaudio driver within NetBSD is susceptible to a missing access control flaw, enabling unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without the necessary permissions. This vulnerability arises from inadequate access checks on the /dev/hdaudioN device nodes. Attackers can exploit this weakness by concurrently executing HDAUDIO_FGRP_SETCONFIG commands across multiple threads, manipulating direct memory access (DMA) and interrupts, creating a use-after-free condition in the hdafg_detach function. As a result, this can lead to critical disruptions such as denial of service to the audio subsystem and potential local kernel privilege escalation, highlighting significant security implications for affected systems.

References