Problem Description:
Several vulnerabilities were found in the bhyve hypervisor's
device models.
The xHCI (USB 3) device model did not validate or save the event
ring size provided by the guest. The size was re-read from guest
memory on each use, and Transfer Request Block (TRB) fields were
loaded without protection against concurrent modification by the
guest. This race condition could be triggered by a guest running
malicious, privileged code. (CVE-2026-101309)
The HDA audio device model did not check for zero-length Buffer
Descriptor List (BDL) entries when starting a stream. A zero-length
entry caused an out-of-bounds read or write during DMA transfer
processing. BDL fields were also subject to modification by the
guest after validation. (CVE-2026-101310)
The framebuffer device model's maximum resolution constants were
duplicated between the framebuffer and RFB modules and had gotten
out of sync. Additionally, writes to the framebuffer BAR could set
arbitrary width and height values without validation, and the
framebuffer BAR I/O and RFB rendering threads were not synchronized.
(CVE-2026-101311)
Impact:
A malicious guest can crash the bhyve process or potentially
execute arbitrary code in the host userspace context running the
virtual machine, subject to bhyve's Capsicum sandbox.