CVE-2026-32848: NetBSD Race Condition Vulnerability

CVE-2026-32848 Overview

CVE-2026-32848 is a race condition vulnerability in the NetBSD opencrypto subsystem. The flaw resides in the cryptodev_op() function and affects NetBSD builds prior to commit ec8451e. Local attackers on symmetric multiprocessing (SMP) systems can trigger a double-free condition by concurrently issuing CIOCCRYPT ioctl operations against the same session identifier. The root cause is mutable per-operation state embedded in the csession struct, which attackers leverage to corrupt kernel heap memory. The weakness is classified under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
Local attackers with low privileges can corrupt the kernel heap and induce kernel panics or potential memory disclosure on SMP NetBSD hosts.

Affected Products

NetBSD source tree prior to commit ec8451efc1565516aba9e7047e1a1a1ce7953a2f
NetBSD kernels with the opencrypto subsystem compiled in on SMP hardware
Systems exposing /dev/crypto to unprivileged users

Discovery Timeline

2026-05-18 - CVE-2026-32848 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-32848

Vulnerability Analysis

The opencrypto subsystem in NetBSD provides userspace access to kernel cryptographic services through /dev/crypto. Userspace processes obtain a session handle via CIOCGSESSION and submit cryptographic operations through the CIOCCRYPT ioctl. Internally, each session is represented by a csession struct that holds session metadata and, prior to the patch, per-operation state.

When two threads on an SMP host issue CIOCCRYPT calls simultaneously against the same session identifier, both code paths in cryptodev_op() operate on the shared mutable fields in csession. The lack of synchronization on this per-operation state lets the second thread observe and free buffers already freed by the first, producing a double-free against the kernel heap allocator.

Root Cause

The csession struct conflated long-lived session state with transient per-operation state. Concurrent cryptodev_op() invocations sharing one csession pointer can both reach the cleanup path that releases operation buffers. The mismatch between the session lifecycle and the operation lifecycle, combined with missing locking on SMP, satisfies the conditions for [CWE-362].

Attack Vector

Exploitation requires local access and the ability to open /dev/crypto. The attacker creates a session, then races multiple threads issuing CIOCCRYPT ioctls against the same session ID. Successful races corrupt the kernel heap, which can lead to denial of service through a kernel panic. Public technical analysis is available in the NASM Blog Post on UAF and the VulnCheck NetBSD Advisory.

-/*	$NetBSD: crypto.c,v 1.131 2022/06/26 22:52:30 riastradh Exp $ */
+/*	$NetBSD: crypto.c,v 1.132 2026/04/29 14:49:51 christos Exp $ */
 /*	$FreeBSD: src/sys/opencrypto/crypto.c,v 1.4.2.5 2003/02/26 00:14:05 sam Exp $	*/
 /*	$OpenBSD: crypto.c,v 1.41 2002/07/17 23:52:38 art Exp $	*/

Source: GitHub NetBSD Commit

The header changes restructure session lookup and free semantics so that operation state no longer shares the csession lifetime:

-/* $NetBSD: cryptodev_internal.h,v 1.3 2017/06/02 09:46:57 knakahara Exp $ */
+/* $NetBSD: cryptodev_internal.h,v 1.4 2026/04/29 14:49:51 christos Exp $ */
 
 extern kmutex_t cryptodev_mtx;
 
 struct csession;
 int cryptodev_op(struct csession *, struct crypt_op *, struct lwp *);
-int cryptodev_mop(struct fcrypt *, struct crypt_n_op *, int, struct lwp *);
+int cryptodev_mop(struct fcrypt *, struct crypt_n_op *, size_t, struct lwp *);
 int cryptodev_session(struct fcrypt *, struct session_op *);
-int cryptodev_msession(struct fcrypt *, struct session_n_op *, int);
-struct csession *cryptodev_csefind(struct fcrypt *fcr, u_int ses);
+void cryptodev_cse_free(struct csession *);
+struct csession *cryptodev_cse_find(struct fcrypt *, uint32_t);

Source: GitHub NetBSD Commit

The patch introduces an explicit cryptodev_cse_free() routine and renames cryptodev_csefind() to cryptodev_cse_find(), decoupling session lifecycle management from per-operation state.

Detection Methods for CVE-2026-32848

Indicators of Compromise

Unexpected kernel panics referencing cryptodev_op, crypto.c, or heap allocator assertions on SMP NetBSD hosts
Crash dumps showing double-free or freelist corruption signatures originating in the opencrypto subsystem
Unprivileged processes opening /dev/crypto and spawning multiple threads issuing CIOCCRYPT against one session ID

Detection Strategies

Audit kernel message buffers (dmesg) and savecore output for panics tied to opencrypto symbols
Inventory NetBSD systems and compare running kernel source revisions against commit ec8451e
Hunt for non-administrative users invoking the /dev/crypto ioctl interface, which is unusual on most production hosts

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized telemetry pipeline for analysis
Alert on repeated CIOCCRYPT ioctl bursts from a single non-root process
Track /dev/crypto open events through process accounting or audit framework rules

How to Mitigate CVE-2026-32848

Immediate Actions Required

Update NetBSD source trees and rebuild kernels to include commit ec8451efc1565516aba9e7047e1a1a1ce7953a2f or later
Restrict access to /dev/crypto to trusted users and services until patched kernels are deployed
Disable the opencrypto userland interface on hosts that do not require it

Patch Information

The upstream fix is the GitHub NetBSD Commit (ec8451efc1565516aba9e7047e1a1a1ce7953a2f), which moves per-operation state out of the shared csession struct and introduces explicit allocation and free routines (cryptodev_cse_find and cryptodev_cse_free). Rebuild and reboot affected kernels after applying the source update. Refer to the VulnCheck NetBSD Advisory for additional remediation context.

Workarounds

Tighten permissions on /dev/crypto so only privileged accounts can open the device node
Remove or disable the cryptodev pseudo-device in the kernel configuration on hosts that do not need userspace crypto offload
Limit local shell access on multi-tenant SMP systems until kernels are rebuilt against the fixed source revision

bash

# Restrict /dev/crypto access pending kernel rebuild
chown root:wheel /dev/crypto
chmod 600 /dev/crypto

# Optionally remove the cryptodev pseudo-device from kernel config
# Edit /usr/src/sys/arch/<arch>/conf/<KERNEL> and comment out:
# pseudo-device crypto
# pseudo-device cryptodev