The bug is a use‑after‑free triggered by the SNDCTL_DSP_SYNCSTART ioctl in the FreeBSD kernel. The ioctl tries to lock all channels in a sync group and will sleep if a lock would block; when it wakes, the sync group structure may have been freed and the code does not protect against this condition. This flaw allows an unprivileged local user to corrupt kernel memory and gain root privileges, a classic CWE‑416 vulnerability.

The vulnerability exists in the FreeBSD kernel for systems that use the sound subsystem and have multiple audio devices. No specific release or version numbers are listed in the advisory, so all kernel releases that contain this ioctl are potentially affected.

The flaw is exploitable by any local user who can open the audio device and issue the SNDCTL_DSP_SYNCSTART ioctl. Because the attack is local and does not require elevated privileges beforehand, it provides a straightforward privilege escalation path. The vulnerability is not listed in KEV, and the EPSS score indicates a very low but non‑zero probability of exploitation (0.00162). The inherent severity of a local privilege escalation still makes the risk high. Until patched, a system operator should treat this threat as critical.