Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.0

FreeBSD bhyve can be crashed or hijacked by guest

CVE-2026-101311 · published 20 days ago
Summary

The bhyve virtual machine manager on FreeBSD has a problem where it accepts invalid screen size settings from a guest and does not properly coordinate its internal threads. A malicious guest could make the bhyve process stop working or run its own code on the host system. Update to the latest FreeBSD release or apply the provided patches to fix the issue.

What to do
  • Update freebsd freebsd to version p5 or later.
Affected software
VendorProductAffected versions
freebsd freebsd < p5
Original advisory text
Multiple vulnerabilities in bhyve device models
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.0 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published15 Oct 2026
Updated26 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-101311 · NVD
CVE-2026-101311 · MITRE
Track software like this
Free during beta