CVE-2026-57843: NetBSD Kernel Address Disclosure Vulnerability

CVE-2026-57843 Overview

CVE-2026-57843 is an information disclosure vulnerability in the NetBSD kernel. The flaw resides in mm_open() within sys/dev/mm.c. World-accessible character devices such as /dev/null and /dev/zero incorrectly receive the PK_KMEM process flag when opened. This misconfiguration allows unprivileged local users to bypass the CANSEE_KPTR obfuscation mechanism. Attackers can then read real kernel virtual addresses for sensitive structures including struct proc, kauth_cred, filedesc, and vmspace through sysctl KERN_PROC queries. The disclosed addresses defeat kernel address space layout randomization (KASLR) and provide primitives for chaining further kernel exploitation.

Critical Impact
Any unprivileged local user can obtain kernel virtual addresses of sensitive structures by simply opening /dev/null or /dev/zero, undermining KASLR and enabling reliable kernel exploit development.

Affected Products

NetBSD operating system (sys/dev/mm.c component)
NetBSD kernel builds exposing world-readable memory devices with the misapplied PK_KMEM flag
Systems relying on CANSEE_KPTR obfuscation for kernel pointer protection

Discovery Timeline

2026-09-11 - CVE-2026-57843 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-57843

Vulnerability Analysis

The vulnerability is an incorrect permission assignment for a critical resource [CWE-732]. NetBSD uses the PK_KMEM process flag to mark processes that have legitimate access to kernel memory contents, such as those opening /dev/kmem. Processes carrying this flag are exempt from the CANSEE_KPTR check, which normally obfuscates kernel pointers returned to userspace.

The mm_open() handler in sys/dev/mm.c applies the PK_KMEM flag to any process that opens a device managed by the memory driver. This includes world-accessible devices like /dev/null and /dev/zero that do not actually expose kernel memory. As a result, ordinary unprivileged processes inherit kernel memory access privileges after opening a benign device node.

Once flagged, an attacker queries sysctl KERN_PROC and receives unmasked kernel virtual addresses for internal structures. These addresses defeat KASLR and provide the foundation for reliable exploitation of secondary kernel vulnerabilities.

Root Cause

The root cause is overly broad application of the PK_KMEM flag inside mm_open(). The handler does not distinguish between devices that legitimately expose kernel memory (/dev/mem, /dev/kmem) and inert devices (/dev/null, /dev/zero). The CANSEE_KPTR obfuscation mechanism trusts the flag as an authorization signal, so the misassignment silently disables kernel pointer masking.

Attack Vector

Exploitation requires only local shell access. An unprivileged user opens /dev/null or /dev/zero, causing the kernel to set PK_KMEM on the calling process. The process then issues sysctl calls with the KERN_PROC MIB to enumerate process descriptors. Returned entries contain real kernel pointers for struct proc, kauth_cred, filedesc, and vmspace instead of masked values. No memory corruption, network access, or user interaction is required.

For implementation details, see the NetBSD Bug Report #60373 and the VulnCheck NetBSD Advisory.

Detection Methods for CVE-2026-57843

Indicators of Compromise

Unprivileged processes opening /dev/null or /dev/zero immediately followed by sysctl calls against the KERN_PROC MIB.
User-space binaries invoking kvm_openfiles or reading process listings that include unmasked kernel virtual addresses.
Non-administrative processes carrying the PK_KMEM process flag when inspected via kernel debugging or audit tooling.

Detection Strategies

Audit openat/open system calls for the memory driver device nodes and correlate with subsequent __sysctl invocations by the same process.
Instrument the kernel or use dtrace probes on mm_open() to flag entries that set PK_KMEM for devices other than /dev/mem and /dev/kmem.
Monitor for unexpected inheritance of PK_KMEM in process credentials across non-root users.

Monitoring Recommendations

Enable NetBSD veriexec and kernel audit logging to record device opens by unprivileged users.
Ship process-execution and syscall telemetry to a central data lake and alert on /dev/null or /dev/zero opens followed by KERN_PROC sysctl reads within a short window.
Review outputs of tools such as ps, fstat, and custom sysctl consumers for the presence of raw kernel addresses in unprivileged contexts.

How to Mitigate CVE-2026-57843

Immediate Actions Required

Apply NetBSD source updates that restrict PK_KMEM assignment in mm_open() to devices that actually expose kernel memory, as tracked in NetBSD Bug #60373.
Rebuild and reboot affected kernels after applying the patch to ensure the corrected mm_open() logic is loaded.
Inventory systems running NetBSD and prioritize multi-user hosts, shared build servers, and any environment permitting untrusted local shell access.

Patch Information

Fix guidance is coordinated through the NetBSD project via Bug Report #60373. Administrators should track the referenced source-tree commit that constrains PK_KMEM assignment inside mm_open() and rebuild the kernel from a patched source. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict permissions on /dev/null and /dev/zero only if application compatibility allows, since these devices are typically world-accessible by design and tightening them will break most workloads.
Limit local shell access on NetBSD systems to trusted administrators until a patched kernel is deployed.
Disable or gate applications that consume KERN_PROC sysctl data from untrusted users to reduce exposure of leaked kernel pointers.

bash

# Configuration example: verify running NetBSD kernel and audit device opens
uname -a
sysctl kern.version

# Enumerate processes with kernel memory access flag (requires patched tooling)
ps -o pid,user,command,flags | grep -i kmem

# Restrict local shell exposure until patched kernel is deployed
vipw   # remove or lock non-essential local accounts