Description

NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from a second thread to trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), where a latched DMA interrupt dereferences a freed callback pointer, resulting in outcomes ranging from audio-subsystem denial of service and kernel panic to potential local kernel privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-12T13:17:22.777Z",
  "pubdate": "2026-08-12T13:17:22.777Z",
  "executiveSummary": "A missing access control vulnerability exists in NetBSD's hdaudio(4) driver located within sys/dev/hdaudio/hdaudio.c.\nThe vulnerability stems from the absence of proper privilege checks when invoking the HDAUDIO_FGRP_SETCONFIG ioctl via /dev/hdaudioN device nodes.\nUnprivileged local attackers can exploit this flaw by issuing the ioctl repeatedly from one thread while simultaneously maintaining active DMA and IRQs from a second thread.\nThis race condition triggers a use-after-free scenario within hdafg_detach() between stream_stop() and stream_disestablish().\nThe resulting memory corruption condition allows a latched DMA interrupt to dereference a freed callback pointer.\nThe impact ranges from audio-subsystem denial of service and kernel panics to potential local kernel privilege escalation.\nSuccessful exploitation requires local access to the system and the ability to interact with the vulnerable audio device nodes without requiring prior elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability is the lack of authorization checks enforcing elevated permissions prior to handling the HDAUDIO_FGRP_SETCONFIG ioctl command on the /dev/hdaudioN device nodes.\nThe vulnerable component is the NetBSD hdaudio(4) driver, specifically implemented in sys/dev/hdaudio/hdaudio.c.\nAuthentication and privilege requirements are minimal, as unprivileged local attackers can directly access the device nodes and execute the ioctl.\nNetwork exposure is not applicable since the vulnerability is strictly local.\nThe attack flow relies on a multi-threaded exploitation strategy designed to win a race condition during device detachment and configuration updates.\nIn the first thread, the attacker repeatedly invokes the HDAUDIO_FGRP_SETCONFIG ioctl to alter function group configurations dynamically.\nIn the second thread, the attacker maintains active DMA operations and interrupt requests (IRQs).\nThis concurrent activity targets hdafg_detach(), specifically exploiting the execution window between stream_stop() and stream_disestablish().\nAs the driver tears down stream resources and frees underlying memory structures, the persistence of active DMA operations causes a latched DMA interrupt to fire.\nWhen this interrupt is processed, it attempts to dereference a callback pointer that has already been deallocated, resulting in a use-after-free condition.\nThe post-exploitation impact includes memory corruption within kernel space, leading to unpredictable kernel behavior, immediate denial of service via kernel panics, or advanced exploitation vectors that could lead to local kernel privilege escalation."
}