NetBSD 10.2 security fixes close a remote kernel bug in ipfilter
NetBSD 10.2 fixes a remotely triggerable ipfilter kernel null-pointer bug and a TCP timestamp leak.
The NetBSD Project shipped NetBSD 10.2 on September 15, fixing a remotely triggerable null-pointer dereference in ipfilter that can crash the kernel. The release also closes a 4-byte kernel stack leak through TCP timestamps and applies unspecified security fixes to NFS and telnet. Bundled components move to OpenSSL 3.0.21, Xorg 21.1.24, and xkbcomp 1.5.0, while libXpm is patched for CVE-2026-4367 and unbound for CVE-2025-11411. No in-the-wild exploitation is reported.
- Remote ipfilter null-pointer dereference can crash a NetBSD kernel
- TCP timestamps leaked four bytes of kernel stack data
- NFS and telnet fixes are listed without CVE details
- libXpm CVE-2026-4367 and unbound CVE-2025-11411 are patched
- Admins should update the kernel and modules before userspace
- Vendors
- NetBSD Project
- Organizations
- NetBSD Project
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-11411 | NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks | 5.7 | <1% | ||
| CVE-2026-4367 | libXpm: A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing… | 5.5 | <1% |
From the original article
1 min read at helpnetsecurity.com
A NetBSD box at the edge of a network, filtering traffic with ipfilter, has been carrying a kernel flaw that someone outside the machine can set off. The bug is a remotely triggerable null pointer dereference in ipfilter, meaning the kernel tries to read memory through a pointer that leads nowhere. In kernel code, that usually ends with the whole system going down.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.