CVE-2026-32848 Details
Description
NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.
A race condition vulnerability has been identified in the NetBSD opencrypto subsystem, prior to commit ec8451e. This vulnerability allows local attackers on SMP systems to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier. The vulnerability arises from mutable per-operation state embedded in the csession structure, which can be exploited to corrupt kernel heap memory.
Users should update to the latest version of NetBSD, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 18, 2026CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NetBSD/src/commit/ec8451efc1565516aba9e7047e1a1a1ce7953a2f | [email protected] | Source CodeVendor |
| https://nasm.re/posts/uaf_netbsd_crypto/ | [email protected] | BundleExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/netbsd-cryptodev-race-condition-double-free-via-cryptodev-op | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetBSD | < commit ec8451e |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | New CVE Received | [email protected] |