CVE-2026-32849: NetBSD Signed Integer Overflow in cryptodev_op via cryptodev.c
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodevop() function in sys/opencrypto/cryptodev.c where the local variable iovlen is declared as a signed int but assigned from an unsigned cop->dstlen value, causing undefined behavior when cop->dstlen exceeds INTMAX. A local attacker with access to /dev/crypto and a compression session type can exploit this vulnerability by providing a dstlen value exceeding INTMAX to trigger a kernel panic through NULL pointer dereference when CONFIGSVS is disabled and corrupted UIO pointer arithmetic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NetBSD sys/opencrypto/cryptodev.c (cryptodev_op via cryptodev.c)to a version that resolves this vulnerability.Patch ec8451e
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32849?
CVE-2026-32849 has a medium severity score of 5.7.
What vulnerability does CVE-2026-32849 describe?
CVE-2026-32849 describes a signed integer overflow vulnerability in the cryptodev_op() function in NetBSD's cryptodev.c.
How do I fix CVE-2026-32849?
To fix CVE-2026-32849, update your NetBSD system to a version that includes the commit ec8451e which addresses this vulnerability.
What are the potential impacts of CVE-2026-32849?
The potential impacts of CVE-2026-32849 include undefined behavior and possible denial of service due to the integer overflow.
Which software versions are affected by CVE-2026-32849?
CVE-2026-32849 affects versions of NetBSD prior to the commit ec8451e.