CVE-2026-32848: Netbsd Src

Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days.

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.

Affected products

Published 2026-05-18. Last modified 2026-07-14.