Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck

CVE-2026-57842NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen

High 7.0

In plain English

A high-severity double free in NetBSD from The NetBSD Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.1%top 97.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.

Affected products (as reported)

Vendor	Product	Versions
The NetBSD Foundation	NetBSD	8.0 – through 8.39.0 – before 9.510.0 – through 10.1

Weakness: CWE-415, CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch Commit vendor-advisory, patch
https://www.vulncheck.com/advisories/netbsd-compat-netbsd32-double-free-use-after-free-via-recvmsg-msg-iovlen third-party-advisory