CVE-2026-57843
Medium
Description
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries.
SeverityMedium
CVSS5.5
Exploit probability—
ProductNetBSD
PublishedSep 11, 2026
First seenSep 11, 2026
Weakness typeCWE-732CWE-732
How to fix
Update
- The NetBSD Foundation NetBSD9.5 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| The NetBSD Foundation NetBSD | 9.0 ≤ v < 9.5, 10.0 ≤ v ≤ 10.1 | 9.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.