NetBSD versions prior to commit ec8451e contain a race condition vulnerability in the cryptodev_op() function within the opencrypto subsystem. Local attackers with low privileges can concurrently issue CIOCCRYPT operations on the same session identifier on symmetric multiprocessing (SMP) systems, triggering a double-free condition. This occurs because mutable per-operation state embedded in the csession struct is exploited, leading to kernel heap memory corruption. The vulnerability is identified as CVE-2026-32848 with a CVSS 4.0 base score of 5.7 (medium severity). No official patch or remediation level is provided in the available data.

Successful exploitation allows local attackers to corrupt kernel heap memory, potentially leading to system instability or privilege escalation. However, exploitation requires local access with low privileges and concurrent operations on SMP systems. There is no indication of remote exploitation or user interaction required. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, administrators should monitor NetBSD security advisories for updates addressing this vulnerability. Until a patch is available, limiting local access and avoiding concurrent CIOCCRYPT operations on the same session identifier on SMP systems may reduce risk.