# CVE-2026-57842

## Summary

- **CVE ID:** CVE-2026-57842
- **Severity:** HIGH
- **CVSS Score:** 7.3 (CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-415, CWE-416
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 11, 2026

## Description

NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.

## Affected Products

- The NetBSD Foundation — NetBSD (8.0)
- The NetBSD Foundation — NetBSD (9.0)
- The NetBSD Foundation — NetBSD (10.0)

## References

- [CNA](https://gnats.netbsd.org/60373)
- [CNA](https://www.vulncheck.com/advisories/netbsd-compat-netbsd32-double-free-use-after-free-via-recvmsg-msg-iovlen)

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._