CVE-2026-101309

Name of the Vulnerable Software and Affected Versions bhyve (affected versions not specified)

Description The xHCI (USB 3) device model fails to validate or save the event ring size provided by the guest. Because the size is re-read from guest memory during each use, Transfer Request Block (TRB) fields are loaded without protection against concurrent modification by the guest. This creates a race condition—a situation where the timing or sequence of events affects the outcome—that can be triggered by a guest running malicious, privileged code. This may result in a crash of the bhyve process or the execution of arbitrary code within the host userspace context, limited by the Capsicum sandbox.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.