CVE-2026-53996
highpriority · track · 0OT risk · elevatedEPSS 0.001 · 2 %ileDEEUEPSS · scored 2026-10-28
NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from a second thread to trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), where a latched DMA interrupt dereferences a freed callback pointer, resulting in outcomes ranging from audio-subsystem denial of service and kernel panic to potential local kernel privilege escalation.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.4–7.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2821NetBSD Foundation NetBSD OS (hdaudio): Schwachstelle ermöglicht Erlangen von Administratorrechten und DoSDeutsch2026-08-12csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in NetBSD Foundation NetBSD OS ausnutzen, um Administratorrechte zu erlangen und um einen Denial-of-Service-Zustand zu verursachen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://cvsweb.NetBSD.org/bsdweb.cgi/src/sys/dev/hdaudio/hdaudio.ccnnvd
- https://gist.github.com/n4sm/c9683ca728ecfada6c726f2a5afb50edcnnvd
- https://gnats.netbsd.org/60492cnnvd
- https://www.vulncheck.com/advisories/netbsd-hdaudio-4-driver-privilege-bypass-use-after-free-via-hdaudio-fgrp-setconfig-ioctlcnnvd
- https://cvsweb.NetBSD.org/bsdweb.cgi/src/sys/dev/hdaudio/hdaudio.cenisa_euvd
- https://gist.github.com/n4sm/c9683ca728ecfada6c726f2a5afb50edenisa_euvd
- https://gnats.netbsd.org/60492enisa_euvd
- https://www.vulncheck.com/advisories/netbsd-hdaudio-4-driver-privilege-bypass-use-after-free-via-hdaudio-fgrp-setconfig-ioctlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan