CVE-2026-57842
HighCVSS 7.0Summary
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX.
Risk Assessment
A local attacker could cause a kernel panic (denial of service) or potentially achieve kernel-level code execution through memory corruption, threatening the stability and security of the entire system.
Recommendation
Update NetBSD to a version containing the fix, and until then restrict the ability of untrusted users to execute 32-bit binaries.
Other vulnerabilities in NetBSD
See all- CVE-2026-57843Medium
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures.
- CVE-2017-1000374Critical
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
- CVE-2026-32849Medium
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX.
- CVE-2026-32848Medium
NetBSD prior to commit ec8451e has a race condition in cryptodev_op() within the opencrypto subsystem. Local attackers can concurrently issue CIOCCRYPT operations on the same session identifier on SMP systems, causing a double-free condition.
- CVE-1999-0764Medium
NetBSD allows ARP packets to overwrite static ARP entries.
- CVE-1999-0763Medium
NetBSD on multi-homed hosts allows ARP packets from one network to modify ARP entries on another connected network.
- CVE-1999-0422Medium
In some cases, mount in NetBSD 1.3.3 allows local users to execute programs in file systems that have the 'noexec' flag set.
Original NVD description (English source)
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.