---
id: CVE-2026-101310
title: >-
  The HDA audio device model did not check for zero-length Buffer Descriptor
  List (BDL) entries when starting a stream
summary: >-
  The HDA audio device model did not check for zero-length Buffer Descriptor
  List (BDL) entries when starting a stream.  A zero-length entry caused an
  out-of-bounds read or write during DMA transfer processing.  BDL fields were
  also subjec…
severity: none
cwe:
  - CWE-126
  - CWE-362
  - CWE-787
vendor: FreeBSD
product: FreeBSD
affected:
  - FreeBSD >= 15.1-RELEASE < p5
  - FreeBSD >= 14.5-RELEASE < p2
  - FreeBSD >= 14.4-RELEASE < p11
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T08:16:36.313'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101310'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:72.bhyve.asc'
    label: secteam@freebsd.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T07:57:27.858Z'
---

## Overview

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.  A zero-length entry caused an out-of-bounds read or write during DMA transfer processing.  BDL fields were also subject to modification by the guest after validation.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.