---
id: CVE-2026-101308
title: >-
  When an audio channel's buffer needs to be resized, the sound(4) driver checks
  that the buffer is not memory-mapped and then drops the channel lock to
  allocate a new buffer
summary: >-
  When an audio channel's buffer needs to be resized, the sound(4) driver checks
  that the buffer is not memory-mapped and then drops the channel lock to
  allocate a new buffer.  An mmap(2) call on another thread can complete during
  this win…
severity: none
cwe:
  - CWE-367
vendor: FreeBSD
product: FreeBSD
affected:
  - FreeBSD >= 15.1-RELEASE < p5
  - FreeBSD >= 14.5-RELEASE < p2
  - FreeBSD >= 14.4-RELEASE < p11
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T07:17:58.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101308'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:71.sound.asc'
    label: secteam@freebsd.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T07:57:27.844Z'
---

## Overview

When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.  An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.

An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.