The vulnerability is a time‑of‑check to time‑of‑use race in FreeBSD’s sound(4) driver. When a channel buffer is resized, the driver checks that the buffer is not memory‑mapped, releases the channel lock, and re‑allocates a new buffer. During the brief period after the lock is dropped, an attacker can perform an mmap on the same buffer from another thread. The race causes the driver to free the now‑mapped buffer without re‑checking, leading to a use‑after‑free in the kernel. An unprivileged local user with access to a sound device can exploit this race to execute code in kernel context and potentially gain higher privileges.

All FreeBSD releases that ship the stock sound(4) driver are affected. The advisory does not list specific versions, so any deployment using the original driver before the patch may be vulnerable.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not included in CISA’s KEV catalog. A local attacker who can orchestrate the timing of an mmap during the buffer resize can trigger the use‑after‑free to elevate privileges, but no widespread automated exploitation is reported at this time.