{"vulnerability": "CVE-2026-101308", "sightings": [{"uuid": "d3fe8b69-d0e3-403e-9709-80c3d1390c6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101308", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117443701676294866", "content": "CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.  An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.\nAn unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-101308https://security.freebsd.org/advisories/FreeBSD-SA-26:71.sound.asc#FreeBSD#CVE_2026_101308#bot", "creation_timestamp": "2026-10-15T07:17:51.073450Z"}]}