CVE-2026-32849

Vulnerability

NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c. The local variable iov_len is declared as a signed int but assigned from the unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX. This code path is reachable by a local user with access to /dev/crypto and a compression session type [1][2].

Exploitation

An attacker must have local access to the system, the ability to open /dev/crypto, and the ability to create a compression session. By providing a dst_len value exceeding INT_MAX in the CIOCCRYPT ioctl request, the signed integer overflow causes the kernel to bypass critical memory allocations while continuing with data copies. When CONFIG_SVS is disabled, this leads to corrupted UIO pointer arithmetic and a NULL pointer dereference, resulting in a kernel panic [1][2].

Impact

Successful exploitation results in a kernel panic (denial of service) via a NULL pointer dereference. No privilege escalation or information disclosure is described in the available references [1][2].

Mitigation

The vulnerability is fixed in NetBSD commit ec8451e (applied 2026-04-29) [3]. Users should update to a version of NetBSD that includes this commit. No workaround is documented, and the CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [2].