Multiple vulnerabilities in the sound(4) mmap path_CVE-2026-49417

7 / 10

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping.

The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).

Basic Information

ID CVE-2026-49417

Source freebsd

Published Jun 27, 2026 at 08:48

Modified Jun 29, 2026 at 12:48

Affected Product

Vendor FreeBSD

Product FreeBSD

Version 15.0-RELEASE

Affected Versions FreeBSD FreeBSD 15.0-RELEASE
FreeBSD FreeBSD 14.4-RELEASE
FreeBSD FreeBSD 14.3-RELEASE

CWE Classification

CWE-416

References

security.freebsd.org /advisories/FreeBSD-SA-26:27.sound.asc

{
    "lastseen": "",
    "description": "Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid.  The freed memory could then be reused elsewhere while still accessible through the stale mapping.\n\nThe /dev/dsp device nodes are world-accessible by default.  On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system.  At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).",
    "published": "2026-06-27T08:48:30.991Z",
    "modified": "2026-06-29T12:48:34.933Z",
    "type": "cve",
    "title": "Multiple vulnerabilities in the sound(4) mmap path",
    "source": "freebsd",
    "references": "https://security.freebsd.org/advisories/FreeBSD-SA-26:27.sound.asc",
    "id": "CVE-2026-49417",
    "bulletinFamily": "",
    "cwe": [
        "CWE-416"
    ],
    "cvelist": null,
    "sourceData": "FreeBSD FreeBSD 15.0-RELEASE\nFreeBSD FreeBSD 14.4-RELEASE\nFreeBSD FreeBSD 14.3-RELEASE",
    "sourceHref": "",
    "cvss": {
        "score": 7,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "FreeBSD",
    "version": "15.0-RELEASE",
    "vendor": "FreeBSD",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}