---
title: Tip: after FreeBSD-SA-26:72, patch bhyve hosts and restart every guest | ctxsec
url: https://ctxsec.com/items/tip-freebsd-bhyve-sa-26-72
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-freebsd-bhyve-sa-26-72.md)

how-to

2026-10-15

### Tip: after FreeBSD-SA-26:72, patch bhyve hosts and restart every guest

On FreeBSD hypervisor hosts: `freebsd-update fetch install` (or `pkg upgrade -r FreeBSD-base` on base-package installs) to 14.4-p11 / 14.5-p2 / 15.1-p5 or newer STABLE, then restart every bhyve VM—or reboot the host. If you cannot patch tonight, drop xhci, hda, and fbuf from guest device configs (VMs without those three are out of scope per the advisory). Remember Capsicum still bounds the host userspace process; treat a successful guest escape as a full host-userspace compromise inside that sandbox and rotate any secrets the bhyve process could read.

Sources: [FreeBSD-SA-26:72.bhyve](https://www.freebsd.org/security/advisories/FreeBSD-SA-26:72.bhyve.asc)