{"id":"CVE-2026-101308","title":"When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer","summary":"When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.  An mmap(2) call on another thread can complete during this win…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-367"],"vendor":"FreeBSD","product":"FreeBSD","affected":["FreeBSD >= 15.1-RELEASE < p5","FreeBSD >= 14.5-RELEASE < p2","FreeBSD >= 14.4-RELEASE < p11"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T16:17:41.437","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101308","references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:71.sound.asc","label":"secteam@freebsd.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T15:40:09.578920Z"},"ingestedAt":"2026-10-15T07:57:27.844Z","epss":0.00074,"epssPercentile":0.00074,"slug":"CVE-2026-101308","body":"## Overview\n\nWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.  An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.\n\nAn unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222440,"id":"CVE-2026-101308","ts":1792081002424,"field":"cvss","old":null,"new":"5.5"},{"seq":222439,"id":"CVE-2026-101308","ts":1792081002424,"field":"severity","old":"none","new":"medium"}]}