CVE-2026-57842: NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen
NetBSD contains a use-after-free and double-free vulnerability in msgrecvcopyin() within the COMPATNETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msgiovlen between 9 and IOVMAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected code is in NetBSD's COMPAT_NETBSD32 compatibility layer. A 64-bit NetBSD system is exposed when local users can execute 32-bit binaries that use recvmsg().
What does an attacker need to trigger the flaw?
An attacker needs local access with the ability to run a 32-bit binary on the affected 64-bit NetBSD system. They can invoke recvmsg() with msg_iovlen set between 9 and IOV_MAX; no user interaction is required.
What is the likely impact of successful exploitation?
Triggering the flaw can cause a kernel panic or kernel memory corruption due to use-after-free and double-free behavior. The provided severity vector indicates impacts to confidentiality, integrity, and availability are all rated high.
How can administrators determine whether a system is potentially affected?
Check whether the system is 64-bit NetBSD and has the COMPAT_NETBSD32 compatibility layer in use or enabled for execution of 32-bit binaries. Systems where untrusted local users can run such binaries have the relevant exposure condition.