Is CVE-2026-57842 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57842 being exploited in the wild.

How severe is CVE-2026-57842?

High severity, with a CVSS score of 7, published 11 September 2026.

Which products and versions are affected?

Netbsd 8.0 through 8.3, 9.0 through 9.4, 10.0 through 10.1, 11.x (pre-patch).

Is there a fix for CVE-2026-57842?

A patch was published on 2026-06-27: Fix committed to NetBSD HEAD Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57842 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-57842?

Check whether you run Netbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57842: NetBSD use-after-free and double-free in COMPAT_NETBSD32 msg_recv_copyin

CVE-2026-57842 · Severity: high · CVSS 7 · Published 2026-09-11

NetBSD's 32-bit compatibility layer contains a memory safety bug in message receiving code that affects 64-bit systems running 32-bit binaries. A local attacker can exploit this by making a specific system call with particular parameters, causing the kernel to crash or corrupt memory, disrupting system availability and potentially compromising the integrity of running applications.

Technologies: Netbsd. Vendors: Netbsd.

Quick answers

Is CVE-2026-57842 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57842 being exploited in the wild.
How severe is CVE-2026-57842?: High severity, with a CVSS score of 7, published 11 September 2026.
Which products and versions are affected?: Netbsd 8.0 through 8.3, 9.0 through 9.4, 10.0 through 10.1, 11.x (pre-patch).
Is there a fix for CVE-2026-57842?: A patch was published on 2026-06-27: Fix committed to NetBSD HEAD Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57842 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-57842?: Check whether you run Netbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free and double-free bug in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer, caused by a missing return statement on the success code path before the cleanup label. When a 32-bit binary running on a 64-bit NetBSD system calls recvmsg() with msg_iovlen between 9 and IOV_MAX, the kernel allocates an iovec buffer but fails to return after successful processing, instead falling through to error-path cleanup code that frees the buffer. The caller then attempts to free the same buffer, triggering a double-free. An attacker with local code execution privileges can trigger kernel panics or memory corruption. The fix was applied via a simple one-line patch (adding return 0; before the cleanup label) and backported to NetBSD 8, 9, 10, and 11.

Affected products

NetBSD NetBSD 8.0 through 8.3, 9.0 through 9.4, 10.0 through 10.1, 11.x (pre-patch)

Timeline

2026-06-26: disclosed: Vulnerability reported to NetBSD via problem report PR #60373
2026-06-27: patched: Fix committed to NetBSD HEAD
2026-06-29: patched: Backports applied to NetBSD 11, 10, and 9 branches
2026-09-11: advisory: CVE-2026-57842 published and indexed in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.