CVE-2026-57842: NetBSD Use-After-Free Vulnerability

CVE-2026-57842 Overview

CVE-2026-57842 is a use-after-free and double-free vulnerability in the NetBSD kernel. The flaw resides in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer. A missing return statement before the cleanup label on the success path causes the kernel to free an already-freed iovec allocation. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger the condition by calling recvmsg() with msg_iovlen between 9 and IOV_MAX. Successful exploitation leads to kernel panic or memory corruption, enabling denial of service and potential local privilege escalation on affected hosts.

Critical Impact
Local attackers executing 32-bit binaries on 64-bit NetBSD can trigger kernel memory corruption or panic, threatening host confidentiality, integrity, and availability.

Affected Products

NetBSD kernels compiled with COMPAT_NETBSD32 support
64-bit NetBSD systems capable of executing 32-bit binaries
Configurations exposing the recvmsg() system call via the 32-bit compat layer

Discovery Timeline

2026-09-11 - CVE-2026-57842 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-57842

Vulnerability Analysis

The vulnerability is a classic double-free condition ([CWE-415]) with a companion use-after-free window. The msg_recv_copyin() routine inside the COMPAT_NETBSD32 layer translates 32-bit msghdr structures into the native 64-bit representation used by the NetBSD kernel. On the success path, the function omits a return statement, causing execution to fall through into the cleanup label that frees the just-allocated native iovec buffer. The caller subsequently uses the pointer and, when the syscall completes, frees the same allocation again.

The defect is reachable from unprivileged local code because the 32-bit compatibility ABI exposes recvmsg() to any user process. The heap allocation path is only taken when msg_iovlen exceeds the small kernel stack cache, requiring a value between 9 and IOV_MAX. Attackers can shape the kernel heap between the first free and the second free to control the memory that gets released twice.

Root Cause

The missing return before the cleanup label conflates the success and failure paths. The cleanup logic assumes the allocation is transient and must be released, but on success the allocation is retained by the caller. Kernel allocator metadata is corrupted when the caller frees the buffer a second time, producing use-after-free reads and writes against reused chunks.

Attack Vector

Exploitation requires local code execution and the ability to invoke a 32-bit binary on a 64-bit host running a COMPAT_NETBSD32 kernel. The attacker constructs a recvmsg() call whose msg_iovlen field falls in the vulnerable 9 to IOV_MAX range, forcing the heap allocation path. Reliable memory corruption requires grooming the kernel heap so a security-sensitive object reoccupies the freed slot before the second free. See the NetBSD Bug Report #60373 and the VulnCheck Advisory on NetBSD for technical details.

Detection Methods for CVE-2026-57842

Indicators of Compromise

Unexpected kernel panics referencing msg_recv_copyin, sockargs, or recvmsg in crash dumps
Allocator diagnostics reporting double-free or freelist corruption in the iovec-sized bucket
Process crash traces from 32-bit binaries invoking recvmsg() with large msg_iovlen values

Detection Strategies

Enable kernel allocator hardening (KASAN, KMEM_REDZONE) on test hosts to surface double frees during triage
Audit process execution telemetry for 32-bit binaries running on 64-bit NetBSD kernels with COMPAT_NETBSD32 enabled
Alert on repeated recvmsg() failures or kernel oops events correlated with unprivileged users

Monitoring Recommendations

Forward /var/log/messages and savecore output to a central log store and alert on panic strings mentioning compat32 socket paths
Track syscall auditing (kauth / veriexec) events for unusual recvmsg() patterns with high msg_iovlen
Baseline the population of hosts with COMPAT_NETBSD32 compiled in and monitor for new deployments

How to Mitigate CVE-2026-57842

Immediate Actions Required

Inventory NetBSD systems whose kernels include the COMPAT_NETBSD32 option and prioritize 64-bit hosts that run 32-bit binaries
Restrict execution of 32-bit binaries on affected hosts to trusted users until a patched kernel is deployed
Enable crash dump collection so any exploitation attempt produces forensic artifacts for follow-up

Patch Information

Monitor the NetBSD Bug Report #60373 for the official source commit and follow the NetBSD security-announce channel for the corresponding advisory. Rebuild affected kernels from patched sources or install vendor-supplied binary updates once available. The upstream fix adds the missing return statement so the success path bypasses the cleanup label and preserves the iovec allocation.

Workarounds

Rebuild the kernel without the options COMPAT_NETBSD32 directive where 32-bit binary support is not required
Prevent unprivileged execution of 32-bit binaries using file system permissions or mandatory access controls
Apply the source-level fix from NetBSD Bug #60373 as an interim patch on custom kernel builds

bash

# Configuration example: disable COMPAT_NETBSD32 in a custom kernel config
# Edit /usr/src/sys/arch/amd64/conf/GENERIC and comment the option:
#options       COMPAT_NETBSD32

cd /usr/src
./build.sh -m amd64 -j$(sysctl -n hw.ncpu) kernel=GENERIC
cp sys/arch/amd64/compile/obj/GENERIC/netbsd /netbsd.patched
shutdown -r now