FreeBSD-SA-26:72.bhyve Security Advisory

{
  "id": "59751937c9152d722d5fb35bcb7577170b32fbd3f6cd2348672b4402e333156f",
  "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-26:72.bhyve.asc",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "FreeBSD-SA-26:72.bhyve Security Advisory",
    "summary": "FreeBSD corrected multiple bhyve device-model vulnerabilities that could let a malicious guest crash bhyve or potentially execute code in the host userspace context. Systems without xhci, hda, and fbuf devices are not affected.",
    "evidence": "Several vulnerabilities were found in the bhyve hypervisor's device models.",
    "products": [
      {
        "name": {
          "value": "FreeBSD",
          "evidence": "Affects: All supported versions of FreeBSD."
        },
        "prerequisites": [
          {
            "value": "Virtual machines that provide none of the \"xhci\", \"hda\", and \"fbuf\" devices to guests are not affected.",
            "evidence": "Virtual machines that provide none of the \"xhci\", \"hda\", and \"fbuf\" devices to guests are not affected."
          }
        ],
        "fixed_versions": [
          {
            "value": "15.1-RELEASE-p5",
            "evidence": "2026-10-14 16:04:40 UTC (releng/15.1, 15.1-RELEASE-p5)"
          },
          {
            "value": "14.5-RELEASE-p2",
            "evidence": "2026-10-14 16:04:14 UTC (releng/14.5, 14.5-RELEASE-p2)"
          },
          {
            "value": "14.4-RELEASE-p11",
            "evidence": "2026-10-14 16:03:57 UTC (releng/14.4, 14.4-RELEASE-p11)"
          }
        ],
        "affected_versions": [
          {
            "value": "All supported versions of FreeBSD",
            "evidence": "Affects: All supported versions of FreeBSD."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-101309",
        "evidence": "(CVE-2026-101309)"
      },
      {
        "value": "CVE-2026-101310",
        "evidence": "(CVE-2026-101310)"
      },
      {
        "value": "CVE-2026-101311",
        "evidence": "(CVE-2026-101311)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-freebsd-security",
  "document_id": 23619,
  "published_at": "2026-10-14T00:00:00+00:00"
}