The vulnerability is a race condition in bhyve's xHCI device model where the size of the event ring supplied by the guest is not validated or stored. The size is re‑read from guest memory each time the ring is used, and the Transfer Request Block fields can be modified by the guest concurrently. This flaw allows a malicious privileged guest to corrupt bhyve's state, potentially crashing the host or executing arbitrary code in bhyve's userspace context, which is still subject to the Capsicum sandbox.

The issue affects FreeBSD's bhyve hypervisor, particularly the xHCI (USB 3) device model. All FreeBSD releases prior to the release that contains the FreeBSD-SA-26:72.bhyve fix are vulnerable. The vulnerability has been documented in the FreeBSD Security Advisory FreeBSD-SA-26:72.bhyve.

The CVSS base score of 7 underscores a moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local to the virtual machine, requiring a malicious guest with privileged code ability. If successful, an attacker could trigger a bhyve crash or potentially run code in bhyve's userspace, elevating privileges relative to the host's sandbox restrictions.