NetBSD hdaudio CVE-2026-53996

The attacker must hold a local unprivileged user account on a NetBSD system with HD Audio hardware present and the hdaudio(4) driver loaded, resulting in accessible /dev/hdaudioN device nodes. The missing access control (CWE-862) means no special group membership, capability, or elevated privilege is required to open those nodes and issue the HDAUDIO_FGRP_SETCONFIG ioctl. The additional requirement is winning a kernel-level race condition between two concurrent threads - stream_stop() versus an in-flight DMA interrupt - which introduces timing dependency on scheduler behavior, CPU count, and system load, making exploitation unreliable rather than deterministic. Remote exploitation is entirely excluded by AV:L; the attacker must have interactive or SSH access to the target. Systems without HD Audio hardware, or configured to not load hdaudio(4), are not affected.

The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) correctly captures the attack profile: local unprivileged access is sufficient due to the missing ioctl guard, but winning the kernel-level race (AC:H) requires precise thread scheduling and is not guaranteed to be reliable across varying load and CPU configurations. The theoretical impact ceiling is nonetheless severe - full kernel memory corruption enabling confidentiality, integrity, and availability compromise of the vulnerable system. No EPSS score was available in the supplied intelligence data, and the vulnerability does not appear in CISA KEV at time of analysis, indicating no confirmed widespread active exploitation. However, a public PoC gist attributed to researcher n4sm substantially reduces the skill barrier, moving this from theoretical to practically exploitable for motivated attackers with local access. Even a mid-sized municipal IT team in boleslawiec operating NetBSD-based infrastructure with untrusted local user accounts should treat this as urgent, since the combination of a public PoC and a missing access control makes the race condition the only meaningful barrier to exploitation. The absence of a confirmed patched release version - only a CVSweb source commit is referenced - introduces remediation uncertainty that extends exposure windows.

An unprivileged user with a local shell account on a multi-user NetBSD system launches the public PoC from the n4sm gist, which spawns two threads: one hammering HDAUDIO_FGRP_SETCONFIG ioctls against /dev/hdaudioN (possible with no privilege check) and one keeping a DMA stream active. When the race is won and a latched DMA interrupt fires after hdafg_detach() has freed the callback structure, the kernel dereferences the freed pointer - yielding a kernel panic at minimum, or corrupted kernel execution state exploitable for local privilege escalation to root.