CVE-2026-57842

NetBSD contains a use-after-free and double-free flaw (CWE-415/CWE-416) in msg_recv_copyin() in the COMPAT_NETBSD32 compatibility layer, caused by a missing return statement before the cleanup label on the success path. Any local user who can execute a 32-bit binary on a 64-bit NetBSD system can trigger it by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to read a freed iovec buffer and then free the same allocation a second time. Successful exploitation can cause kernel memory corruption or a kernel panic, with the CVSS 4.0 high-impact confidentiality, integrity, and availability metrics indicating potential for serious local impact on the host. Affected systems are 64-bit NetBSD installations with COMPAT_NETBSD32 enabled where untrusted local users can run 32-bit binaries. There is no evidence of exploitation in the wild, no entry in CISA KEV, and no public proof-of-concept is known.

What to do: Track the official NetBSD security advisory and apply the released patch or upgrade to a fixed NetBSD release/current branch as soon as the fixed version is identified. As an interim mitigation, disable or unload the compat_netbsd32 module on multi-user 64-bit systems, or restrict which local users may execute 32-bit binaries. Prioritize hosts that provide shell access to untrusted users, since exploitation requires local code execution.