Multiple vulnerabilities in bhyve device models

Description

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

Scores

EPSS (exploitation in 30 days)

0.12% · top 98% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

• CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (opens in a new tab)All about CWE-362 and its CVEs

Affected products

• FreeBSD · FreeBSD

  • affected 15.1-RELEASE – < p5
  • affected 14.5-RELEASE – < p2
  • affected 14.4-RELEASE – < p11

References (1)

• https://security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-101309](https://trackcve.app/badge/CVE-2026-101309.svg)](https://trackcve.app/cve/CVE-2026-101309)

Record last updated 16 Oct 2026, 03:56 UTC.