CVE-2026-57843 is an information disclosure vulnerability in NetBSD's mm_open() function within sys/dev/mm.c. Unprivileged local users can exploit this vulnerability to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero. The vulnerability is caused by these devices incorrectly receiving the PK_KMEM process flag, allowing attackers to bypass the CANSEE_K [truncated]
A use-after-free and double-free vulnerability exists in NetBSD's COMPAT_NETBSD32 compatibility layer due to a missing return statement in msg_recv_copyin(). Local users can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX. The vulnerability allows local users to potentially escalate privileges, cause system instability, or trigger a kernel panic. NetB [truncated]
CVE-2026-53996 debrief based on the supplied source corpus. The vulnerability is a missing access control issue in NetBSD's hdaudio(4) driver, allowing unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl. This could lead to denial of service, kernel panic, or local kernel privilege escalation. Defenders should assess exposure and prioritize verification of access controls on /dev/hdaud [truncated]
