Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-53996NetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctl

High 7.0

In plain English

A high-severity missing authorization in NetBSD from The NetBSD Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.1%top 97.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from a second thread to trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), where a latched DMA interrupt dereferences a freed callback pointer, resulting in outcomes ranging from audio-subsystem denial of service and kernel panic to potential local kernel privilege escalation.

Affected products (as reported)

Vendor	Product	Versions
The NetBSD Foundation	NetBSD	0 – through 11

Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Gist technical-description
Problem Report issue-tracking
Fixed File patch
https://www.vulncheck.com/advisories/netbsd-hdaudio-4-driver-privilege-bypass-use-after-free-via-hdaudio-fgrp-setconfig-ioctl third-party-advisory