An unprivileged user who can create a mapping to the /dev/dsp device can exploit a use‑after‑free flaw in the sound(4) mmap path. The sound driver frees the audio buffer when the device is closed, yet the memory mapping created earlier remains valid. The attacker can read and write the freed kernel memory through this stale mapping, enabling arbitrary kernel memory manipulation. This capability can be abused to gain elevated privileges or to crash the kernel, leading to a denial‑of‑service. The underlying weakness is categorised as CWE‑416: Use After Free.

All FreeBSD installations running the standard sound subsystem that expose the /dev/dsp device with the default world‑writable permissions are affected. The vulnerability applies to any system that implements the sound(4) mmap interface and uses the /dev/dsp character device.

The CVE record does not provide a CVSS score or EPSS estimate, so the numeric severity cannot be stated. However, because the flaw allows direct access to kernel memory from any user on the host, the risk is high. An attacker with local user access can read or corrupt kernel data, elevate to root, or crash the system. No publicly available checklists or exploits are listed in CISA KEV, but the fundamental nature of the vulnerability implies a high likelihood of exploitation in a controlled local environment.