FreeBSD-SA-26:71.sound Security Advisory

{
  "id": "0666e5835e611cd0fc2d28b79739f8e1315ba6e2b3d3a950176e75cbef7aa8fc",
  "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-26:71.sound.asc",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "FreeBSD-SA-26:71.sound Security Advisory",
    "summary": "FreeBSD corrected a race in sound(4) buffer resizing and mmap that could allow an unprivileged local user with sound-device access to trigger a kernel use-after-free and potentially escalate privileges. Upgrade to a corrected supported branch and reboot; systems without sound devices are unaffected.",
    "evidence": "When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.",
    "products": [
      {
        "name": {
          "value": "FreeBSD",
          "evidence": "All supported versions of FreeBSD."
        },
        "prerequisites": [
          {
            "value": "An unprivileged local user with access to a sound device",
            "evidence": "An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges."
          }
        ],
        "fixed_versions": [
          {
            "value": "15.1-RELEASE-p5",
            "evidence": "2026-10-14 16:04:37 UTC (releng/15.1, 15.1-RELEASE-p5)"
          },
          {
            "value": "14.5-RELEASE-p2",
            "evidence": "2026-10-14 16:04:10 UTC (releng/14.5, 14.5-RELEASE-p2)"
          },
          {
            "value": "14.4-RELEASE-p11",
            "evidence": "2026-10-14 16:03:54 UTC (releng/14.4, 14.4-RELEASE-p11)"
          }
        ],
        "affected_versions": [
          {
            "value": "All supported versions of FreeBSD.",
            "evidence": "Affects: All supported versions of FreeBSD."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-101308",
        "evidence": "CVE Name: CVE-2026-101308"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-freebsd-security",
  "document_id": 23622,
  "published_at": "2026-10-14T00:00:00+00:00"
}