---
title: FreeBSD-SA-26:72.bhyve: guest can crash bhyve or run host-userspace code via xHCI/HDA/framebuffer flaws | ctxsec
url: https://ctxsec.com/items/freebsd-sa-26-72-bhyve
description: ""
status: "confirmed (vendor); no known exploitation"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/freebsd-sa-26-72-bhyve.md)

confirmed (vendor); no known exploitation

2026-10-14

### FreeBSD-SA-26:72.bhyve: guest can crash bhyve or run host-userspace code via xHCI/HDA/framebuffer flaws

FreeBSD announced FreeBSD-SA-26:72.bhyve on Oct 14 covering three device-model bugs in the bhyve hypervisor: an xHCI event-ring/TRB race (CVE-2026-101309), HDA zero-length BDL DMA out-of-bounds access (CVE-2026-101310), and framebuffer/RFB validation and sync issues (CVE-2026-101311). A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context that runs the VM, still subject to bhyve's Capsicum sandbox. All supported FreeBSD versions are affected. Corrected builds: 14.4-RELEASE-p11, 14.5-RELEASE-p2, 15.1-RELEASE-p5 (and matching STABLE). After upgrading, restart all bhyve VMs or reboot. No workaround; VMs that expose none of the xhci, hda, or fbuf devices are not affected. Credits include researchers using Anthropic Opus 4.8, Claude, and GLM-5.1. Not on CISA KEV as of catalogVersion 2026.10.14.

Sources: [FreeBSD-SA-26:72.bhyve](https://www.freebsd.org/security/advisories/FreeBSD-SA-26:72.bhyve.asc) · [FreeBSD security advisories](https://www.freebsd.org/security/advisories/)