---
id: CVE-2026-101309
title: >-
  The xHCI (USB 3) device model did not validate or save the event ring size
  provided by the guest
summary: >-
  The xHCI (USB 3) device model did not validate or save the event ring size
  provided by the guest.  The size was re-read from guest memory on each use,
  and Transfer Request Block (TRB) fields were loaded without protection against
  concurr…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-362
vendor: FreeBSD
product: FreeBSD
affected:
  - FreeBSD >= 15.1-RELEASE < p5
  - FreeBSD >= 14.5-RELEASE < p2
  - FreeBSD >= 14.4-RELEASE < p11
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T04:18:06.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101309'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc'
    label: secteam@freebsd.org
tags:
  - nvd
  - cve.org
epss: 0.00117
epssPercentile: 0.01669
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T15:47:53.886483Z'
ingestedAt: '2026-10-15T07:57:27.858Z'
---

## Overview

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.  The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest.  This race condition could be triggered by a guest running malicious, privileged code.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.