PatchTheCVECVE-2026-101308: When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-m
CVE-2026-101308 is a medium-severity flaw (CVSS 5.5) affecting freebsd. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potential
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 100%) |
| CISA exploited list | No |
| Weakness | CWE-367 |
| Published | 2026-10-15 |
| Last modified | 2026-10-19 |
Last updated 2026-10-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-101308?
freebsd: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2026-101308 being exploited?
CVE-2026-101308 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-101308 affect?
CVE-2026-101308 affects freebsd. Severity is medium (CVSS 5.5). When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window
How urgent is CVE-2026-101308?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-101304 HIGH 7.1 MITIGATE When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that di
- CVE-2026-101307 CRITICAL 9.1 MITIGATE When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
- CVE-2026-101306 CRITICAL 9.8 MITIGATE SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred
- CVE-2026-101305 HIGH 8.8 MITIGATE renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments
- CVE-2026-101303 HIGH 7.5 MITIGATE The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destinati