Vulnerability · Published May 18, 2026 · Assigned by VulnCheck

CVE-2026-32848NetBSD cryptodev Race Condition Double-Free via cryptodev_op()

Medium 4.7

In plain English

A medium-severity double free in src from NetBSD. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)<0.1%top 99.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.

Affected products (as reported)

Vendor	Product	Versions
NetBSD	src	0 – before ec8451efc1565516aba9e7047e1a1a1ce7953a2f

Weakness: CWE-415, CWE-362 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://nasm.re/posts/uaf_netbsd_crypto/ technical-description, exploit
https://github.com/NetBSD/src/commit/ec8451efc1565516aba9e7047e1a1a1ce7953a2f patch
https://www.vulncheck.com/advisories/netbsd-cryptodev-race-condition-double-free-via-cryptodev-op third-party-advisory