Which versions of NetBSD hdaudio are affected by CVE-2026-53996?

CVE-2026-53996 in NetBSD's hdaudio driver allows unprivileged local users to escalate to kernel privilege level using publicly available exploit code.. A patch is available.

How to fix or mitigate CVE-2026-53996?

Within 24 hours, identify all NetBSD systems in your infrastructure and determine which versions are running. Within 7 days, source NetBSD's patched kernel code from the vendor advisory, rebuild the kernel, and deploy to all affected systems; if immediate patching is not feasible, restrict permissions on /dev/hdaudioN device nodes to prevent unprivileged user access. Within 30 days, verify all systems run a patched kernel version, audit local user access controls across affected systems, and review local privilege escalation detection capabilities.

NetBSD hdaudio CVE-2026-53996

Q: What is the CVSS score of CVE-2026-53996?

CVE-2026-53996 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-57210 HIGH

Missing Authorization (CWE-862)

2026-08-12 VulnCheck

GHSA-2q5f-pw9r-2w7m

Authentication Bypass Privilege Escalation Denial Of Service Netbsd

7.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local unprivileged access sufficient (PR:L) due to missing ioctl guard, but timing-dependent race mandates AC:H; no scope change as kernel impact is self-contained per 4.0 SC/SI/SA:N.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 13:19 vuln.today

CVE Published

Aug 12, 2026 - 12:42 cve.org

HIGH 7.3

DescriptionCVE.org

NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from a second thread to trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), where a latched DMA interrupt dereferences a freed callback pointer, resulting in outcomes ranging from audio-subsystem denial of service and kernel panic to potential local kernel privilege escalation.

AnalysisAI

Local kernel privilege escalation and denial of service in NetBSD's hdaudio(4) driver arise from two compounding flaws: the /dev/hdaudioN device nodes enforce no access control, allowing any unprivileged local user to invoke HDAUDIO_FGRP_SETCONFIG, and the detach path in hdafg_detach() is not race-safe against concurrent DMA activity. A two-thread attack - one repeatedly reconfiguring the audio function group, one keeping DMA and IRQs live - wins a use-after-free race where a latched DMA interrupt dereferences a freed callback pointer, producing outcomes from audio-subsystem crashes and kernel panics to potential kernel-level privilege escalation. A public proof-of-concept is available, and no specific patched release version has been confirmed, leaving remediation dependent on source-level kernel rebuilds.

Technical ContextAI

The vulnerability is in sys/dev/hdaudio/hdaudio.c, the kernel driver implementing HD Audio (Intel HDA) support in NetBSD. The root cause class is CWE-862 (Missing Authorization): character device nodes /dev/hdaudioN are created without privilege checks on the HDAUDIO_FGRP_SETCONFIG ioctl handler, which initiates audio function group reconfiguration and triggers the hdafg_detach() teardown path. That teardown calls stream_stop() and then stream_disestablish() sequentially, but does not quiesce DMA and IRQ state before freeing the stream callback structure. A latched DMA interrupt arriving between those two calls dereferences a callback pointer that has already been freed - a textbook use-after-free race condition. The affected CPE is cpe:2.3:a:the_netbsd_foundation:netbsd:*:*:*:*:*:*:*:* with no version upper bound, implying all current NetBSD releases carrying this driver are potentially vulnerable. The HDA bus is present on virtually all modern x86 and ARM desktop/laptop hardware, so the driver is loaded in most general-purpose NetBSD deployments.

RemediationAI

A source-level patch is available via the NetBSD CVSweb repository at https://cvsweb.NetBSD.org/bsdweb.cgi/src/sys/dev/hdaudio/hdaudio.c; administrators should apply the updated hdaudio.c and rebuild and reinstall the kernel, though no specific tagged NetBSD release incorporating this fix has been confirmed from the available references. On multi-user systems where immediate kernel rebuild is not feasible, restricting permissions on /dev/hdaudioN device nodes - for example via devfs rules in /etc/devfs.conf - to root or a privileged audio group will block unprivileged ioctl access and eliminate the exploitation vector, at the trade-off of preventing non-root audio playback. On systems where HD Audio functionality is not required at all, unloading or blacklisting the hdaudio(4) driver entirely removes the attack surface with no security downside, though audio hardware will become unavailable. Monitor https://gnats.netbsd.org/60492 for an official patched release announcement before closing compensating controls.