CVE-2026-32848

Katalog CVE

CVSS 4.7 · Medium EPSS 0,10%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). Skor CVSS 3.1 4.7 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

14 Juli 2026

Status NVD

Deferred

CVSS 3.1

4.7 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-415: Double Free

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/NetBSD/src/commit/ec8451efc1565516aba9e7047e1a1a1ce7953a2f
• https://nasm.re/posts/uaf_netbsd_crypto/
• https://www.vulncheck.com/advisories/netbsd-cryptodev-race-condition-double-free-via-cryptodev-op