CVE-2026-45258: FreeBSD Audio Driver Integer Overflow – Privilege Escalation

Technical summary

The `dsp_mmap_single()` function in FreeBSD's audio subsystem validates user-supplied memory mapping requests by summing an offset and length, then comparing against the buffer size. A 64-bit integer overflow in this sum allows an attacker to craft values that wrap around, passing the bounds check while resulting in an out-of-bounds mapping. The offset is subsequently truncated to 32 bits when converted to a kernel address, permitting the attacker to map memory regions beyond the intended audio buffer into arbitrary kernel memory space. This combination of integer overflow (CWE-190) and out-of-bounds write (CWE-787) creates a direct path to kernel memory corruption.

Business impact

Any FreeBSD system with an audio device is vulnerable to local privilege escalation. An attacker with unprivileged shell access can gain kernel-level control, allowing them to steal sensitive data, install persistent malware, disrupt services, or pivot to other systems. Organizations running FreeBSD in multi-tenant or shared-access environments face elevated risk. At minimum, attackers can cause immediate Denial of Service by crashing the kernel, disrupting business continuity.

Affected systems

All listed FreeBSD versions are affected by this vulnerability. Systems with active audio devices and `/dev/dsp` device nodes present the highest risk. Check your FreeBSD installation for audio subsystem modules and confirm the presence of `/dev/dsp` with `ls -la /dev/dsp*`. Even systems without active audio use may carry the vulnerable code in the kernel image.

Exploitability

Exploitability is straightforward for any user with local shell access. The `/dev/dsp` device is world-accessible by default, requiring no special privileges to open or invoke the vulnerable mmap operation. No user interaction, special kernel configuration, or remote capability is needed. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector with low complexity. The primary barrier is gaining initial local access; once present, exploitation is reliable.

Remediation

Patch your FreeBSD system to a version that corrects the integer overflow check in `dsp_mmap_single()`. Review the official FreeBSD security advisories and FreeBSD-SA notifications for the specific patch release applicable to your running version. Verify against the vendor advisory for exact patch version numbers and associated errata. As an interim measure, restrict access to `/dev/dsp` device nodes via file permissions or devfs rules if audio functionality is not required, though this is not a complete fix for kernel module vulnerability.

Patch guidance

FreeBSD will issue formal security patches through the FreeBSD security advisory process. Monitor the FreeBSD Security page and subscribe to FreeBSD-SECURITY mailing list for official guidance. Apply patches as soon as they become available for your supported FreeBSD release branch. Verify patch applicability to your specific version before deployment. Test patches in a non-production environment first to confirm compatibility with your audio subsystem configuration and any dependent applications.

Detection guidance

Monitor system logs for suspicious mmap calls to `/dev/dsp` with unusual offset and length values, particularly those that appear designed to wrap around a boundary check. Kernel debug logs or DTrace probes on the `dsp_mmap_single()` function may reveal exploitation attempts. Host-based intrusion detection systems can flag processes opening `/dev/dsp` with escalated privileges following the call. Kernel panic logs with memory corruption signatures warrant investigation for exploitation. Audit `/dev/dsp` access patterns in environments where the device should be unused.

Why prioritize this

This vulnerability represents direct kernel memory access from an unprivileged user on systems with audio devices. The combination of wide-open default permissions, low exploitation complexity, and high-impact outcomes (privilege escalation, arbitrary memory read/write, DoS) makes it a critical priority. Any FreeBSD system in production should be patched immediately. The vulnerability does not require network access or sophisticated attack infrastructure, making it likely to be exploited rapidly once weaponized tools circulate.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) is driven by local attack vector, low attack complexity, and high impact across confidentiality, integrity, and availability. The absence of privilege requirement (unprivileged local user) and lack of user interaction elevate the score despite the local-only attack surface. The score appropriately reflects the severity of unrestricted kernel memory access; the practical impact (kernel takeover) exceeds the numeric score.

Frequently asked questions