Use-after-free in FreeBSD sound(4) driver mmap path (CVE-2026-49417)

The FreeBSD sound(4) driver contains a use-after-free vulnerability in its mmap(2) support. When a mapped audio device is closed, the underlying audio buffer can be freed while the mapping remains valid, allowing the freed memory to be reallocated and accessed through the stale mapping. On systems with an audio device, an unprivileged local user can exploit this to read and write arbitrary kernel memory, enabling privilege escalation to full system control or, at minimum, a kernel crash resulting in a Denial of Service. Affected versions: - All supported versions of FreeBSD We recommend updating to: 15.1-RC3-p1, 15.0-RELEASE-p10, 14.4-RELEASE-p6, 14.3-RELEASE-p15. CVSS 7.0 · our assessment: this_week Reference: https://security.freebsd.org/advisories/FreeBSD-SA-26:27.sound.asc Details: https://vuln.today/cve/CVE-2026-49417