PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32848 NetBSD CVE debrief

A race condition in NetBSD's opencrypto subsystem (cryptodev_op()) allows local attackers to trigger double-free memory corruption on SMP systems by concurrently issuing CIOCCRYPT operations on the same session identifier. The vulnerability stems from mutable per-operation state embedded in the csession struct, enabling kernel heap corruption. This affects NetBSD versions prior to commit ec8451e. The CVSS 4.0 vector indicates local attack vector with high attack complexity, low privileges required, and high availability impact. No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
NetBSD
Product
src
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-05-18
Advisory published
2026-05-18
Advisory updated
2026-05-18

Who should care

NetBSD system administrators operating multi-processor systems with opencrypto/cryptodev enabled; security teams managing BSD-based infrastructure; kernel developers maintaining cryptographic subsystem code

Technical summary

The cryptodev_op() function in NetBSD's opencrypto subsystem contains a race condition where concurrent CIOCCRYPT operations on the same session identifier can trigger a double-free condition. The vulnerability exists because per-operation state is stored mutably within the csession structure, which is shared across operations. On symmetric multiprocessing (SMP) systems, an attacker with local access can exploit this timing window to corrupt kernel heap memory. Successful exploitation could lead to system instability or potential privilege escalation. The vulnerability was addressed in NetBSD src commit ec8451efc1565516aba9e7047e1a1a1ce7953a2f.

Defensive priority

medium

Recommended defensive actions

  • Apply NetBSD src commit ec8451e or later to affected systems
  • Restrict local access to cryptodev device nodes (/dev/crypto) to trusted users only
  • Monitor for unusual cryptodev session activity or kernel crashes on multi-processor systems
  • Review system logs for signs of local privilege escalation attempts
  • Consider disabling hardware crypto acceleration if not required, falling back to software implementations
  • Audit for unauthorized local user accounts that could leverage this vulnerability

Evidence notes

Vulnerability disclosed via VulnCheck advisory with technical analysis published at nasm.re. Fix committed to NetBSD src repository. NVD status currently Deferred.

Official resources

2026-05-18