FreeBSD Kernel Memory /dev/dsp dsp_mmap_single out-of-bounds

Summaryinfo

A vulnerability, which was classified as critical, was found in FreeBSD. Affected by this issue is the function dsp_mmap_single of the file /dev/dsp of the component Kernel Memory Handler. Such manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2026-45258. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in FreeBSD (affected version not known). Affected by this issue is the function dsp_mmap_single of the file /dev/dsp of the component Kernel Memory Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality. CVE summarizes:

dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel memory. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).

The weakness was shared by 75Acol, Ch0Wn, Zer0Duck and Emmanuel Genier. The advisory is available at security.freebsd.org. This vulnerability is handled as CVE-2026-45258 since 05/11/2026. The exploitation is known to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-39962). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Name

• FreeBSD

License

• open-source

Website

• Product: https://www.freebsd.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion