FreeBSD sound(4) EUVD-2026-101883

Requires local, authenticated access to a FreeBSD host and permission to open a sound(4) audio device (a desktop/workstation or multi-user scenario rather than a headless server). The attacker must concurrently (1) trigger an audio-channel buffer resize and (2) issue an mmap(2) on the same buffer from another thread so the mapping completes during the brief interval after the driver verifies the buffer is not mapped and drops the channel lock to reallocate. Limiting factors: exploitation is local-only (not remotely reachable), needs device access privileges, and depends on winning a non-deterministic TOCTOU timing race (CWE-367), so success is probabilistic and may require many attempts. Affected and unpatched versions only: FreeBSD 15.1-RELEASE before p5, 14.4-RELEASE before p11, and 14.5-RELEASE before p2.

This is a genuine but lower-tier priority. All exploitation signals point to a constrained, local-only threat: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) requires an authenticated local user with access to a sound device, EPSS is very low (0.11%, 1st percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis - a convergent low-urgency picture with no conflicting signals on likelihood. The one notable tension is impact scoping: the vendor vector sets C:N/I:N/A:H (availability-only), yet the description explicitly states the use-after-free can be leveraged for privilege escalation in the kernel, which realistically implies confidentiality and integrity impact as well - this understates true impact, so the headline 5.5 likely undersells a successful exploit. Additionally, CWE-367 (TOCTOU race) means reliable exploitation depends on winning a narrow timing window after the channel lock is dropped, which the vendor's AC:L arguably understates (kernel UAF-via-race primitives are typically probabilistic and non-trivial to weaponize). Net: a credible local privilege-escalation race worth patching on multi-user and desktop FreeBSD systems, but not an internet-facing or mass-exploitation concern.

An unprivileged local user with access to a sound device opens an audio channel and, from one thread, triggers a buffer resize while a second thread races an mmap(2) call to map the buffer precisely during the window where the driver has dropped the channel lock. If the race is won, the resize path frees a buffer that is now mapped, yielding a kernel use-after-free the attacker grooms to corrupt kernel memory and escalate to root. No public proof-of-concept was identified at time of analysis, and reliability depends on repeatedly hitting the narrow timing window.