---
id: CVE-2026-101309
title: >-
  The xHCI (USB 3) device model did not validate or save the event ring size
  provided by the guest
summary: >-
  The xHCI (USB 3) device model did not validate or save the event ring size
  provided by the guest.  The size was re-read from guest memory on each use,
  and Transfer Request Block (TRB) fields were loaded without protection against
  concurr…
severity: none
cwe:
  - CWE-362
vendor: FreeBSD
product: FreeBSD
affected:
  - FreeBSD >= 15.1-RELEASE < p5
  - FreeBSD >= 14.5-RELEASE < p2
  - FreeBSD >= 14.4-RELEASE < p11
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T08:16:36.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101309'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc'
    label: secteam@freebsd.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T07:57:27.858Z'
---

## Overview

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.  The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest.  This race condition could be triggered by a guest running malicious, privileged code.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.