Use-After-Free and Double-Free Vulnerability in NetBSD Compatibility Layer

CVE-2026-57842

What is CVE-2026-57842?

NetBSD has a vulnerability in the COMPAT_NETBSD32 compatibility layer that enables local users executing 32-bit binaries on a 64-bit system to trigger severe issues such as kernel panics or memory corruption. This arises from improper handling of the 'msg_recv_copyin()' function, where a missing return statement permits the kernel to reference freed memory. By calling 'recvmsg()' with 'msg_iovlen' values between 9 and IOV_MAX, an attacker can exploit this flaw, leading to a potential compromise and instability in the system.

References