The hdaudio(4) driver lacks sufficient access control, allowing any local user to call the HDAUDIO_FGRP_SETCONFIG ioctl on /dev/hdaudioN without permission. By concurrently issuing this ioctl and keeping DMA and IRQ resources live, an attacker can trigger a use‑after‑free race in hdafg_detach(), causing corrupt memory accesses that may lead to denial of service, kernel panic, or local privilege escalation.

This vulnerability affects the NetBSD operating system from The NetBSD Foundation. No specific product versions were listed, suggesting the defect may be present in multiple releases until official patches are applied.

The CVSS score of 7.3 signals moderate to high severity. EPSS data is missing, and the flaw is not yet catalogued in the CISA KEV list. Exploitation requires local access to the device node and the ability to execute an ioctl; a proper race condition must be orchestrated, but the lack of access checks makes the attack straightforward for an unprivileged user.