QSearchQSearch

CVE-2026-32848

4.7 MEDIUM

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows loca...

Published: 2026-05-18 · Last updated: 2026-05-18

Severity and scoring

CVSS
4.7 MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-362, CWE-415

Description

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2025-13036 — An authentication bypass security issue exists within FactoryTalk Historian Site Edition
  • CVE-2026-48708 — OliveTin gives access to predefined shell commands from a web interface (7.5 HIGH)
  • CVE-2026-54229 — A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method (7.0 HIGH)
  • CVE-2026-12043 — Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor oper... (8.8 HIGH)
  • CVE-2026-46690 — unbounded_spsc is an "unbounded" extension of bounded_spsc_queue (5.8 MEDIUM)