Read the docs
TI-2026-25311 Aliases CVE-2026-32848GHSA-5qv9-q5h2-c748

NetBSD cryptodev Race Condition Double-Free via cryptodev_op()

Priority MEDIUM 59CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00082 0th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NetBSD src ec8451efc1565516aba9e7047e1a1a1ce7953a2f

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-25312 NetBSD Signed Integer Overflow in cryptodev_op via cryptodev.cPriority MEDIUM 59
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32848
  2. 2026-10-03 Alias added: GHSA-5qv9-q5h2-c748

References

Exploit 1

Patch 1

  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2002-01263 Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 10.0
  • TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
  • TI-1999-00045 Buffer overflow of rlogin program using TERM environmental variable. CVSS 2.0HIGH 10.0
  • TI-2014-06993 The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through… CVSS 2.0HIGH 7.5
See all 173 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences