CVE-2026-101310 — Multiple vulnerabilities in bhyve device models
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write …
Published: 2026-10-15 · CVSS: 7.0 · CVSS 3.1
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7