CVE-2026-57843NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure

Descripción

NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• Patch Commit vendor-advisorypatch
• https://www.vulncheck.com/advisories/netbsd-mm-open-pk-kmem-flag-kernel-pointer-information-disclosure third-party-advisory