Is CVE-2026-57843 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57843 being exploited in the wild.

How severe is CVE-2026-57843?

Medium severity, with a CVSS score of 5.5, published 11 September 2026.

Which products and versions are affected?

Netbsd 9.0 to <9.5, 10.0 to 10.1.

Is there a fix for CVE-2026-57843?

A patch was published on 2026-06-27: Fix committed to HEAD Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57843 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-57843?

Check whether you run Netbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57843: NetBSD mm_open() information disclosure via PK_KMEM flag

Q: Which products and versions are affected?

Netbsd 9.0 to <9.5, 10.0 to 10.1.

Q: Is there a fix for CVE-2026-57843?

A patch was published on 2026-06-27: Fix committed to HEAD Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57843 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-57843?

Check whether you run Netbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57843 · Severity: medium · CVSS 5.5 · Published 2026-09-11

NetBSD's device memory access system incorrectly grants kernel memory privileges to unprivileged users opening standard devices like /dev/null and /dev/zero. This misconfiguration allows attackers to bypass kernel pointer obfuscation protections and extract sensitive kernel memory addresses, which can be used to defeat kernel address space layout randomization and facilitate further attacks against the operating system.

Technologies: Netbsd. Vendors: Netbsd.

Quick answers

Is CVE-2026-57843 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57843 being exploited in the wild.
How severe is CVE-2026-57843?: Medium severity, with a CVSS score of 5.5, published 11 September 2026.
Which products and versions are affected?: Netbsd 9.0 to <9.5, 10.0 to 10.1.
Is there a fix for CVE-2026-57843?: A patch was published on 2026-06-27: Fix committed to HEAD Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57843 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-57843?: Check whether you run Netbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in mm_open() within sys/dev/mm.c, where world-accessible memory devices incorrectly receive the PK_KMEM process flag during opening. This flag is intended only for privileged processes that need legitimate kernel memory access. The flaw allows unprivileged local users to bypass the CANSEE_KPTR obfuscation mechanism, which normally hides kernel virtual addresses from non-root users. Attackers can then query sysctl KERN_PROC endpoints to read kernel virtual addresses for sensitive structures including struct proc, kauth_cred, filedesc, and vmspace. The attack requires local access to the system but no special privileges or user interaction. Patches have been committed to NetBSD and are available in current and stable release branches.

Affected products

NetBSD NetBSD 9.0 to <9.5, 10.0 to 10.1

Timeline

2026-09-11: disclosed
2026-06-27: patched: Fix committed to HEAD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.