NetBSD versions before commit ec8451e contain a vulnerability in sys/opencrypto/cryptodev.c where the cryptodev_op() function uses a signed integer (iov_len) assigned from an unsigned source (cop->dst_len). When cop->dst_len exceeds the maximum value for a signed int (INT_MAX), this causes a signed integer overflow or wraparound, resulting in undefined behavior. A local attacker with access to /dev/crypto and a compression session type can exploit this by supplying a dst_len value exceeding INT_MAX, triggering a kernel panic through NULL pointer dereference due to corrupted UIO pointer arithmetic when CONFIG_SVS is disabled.

The vulnerability can cause a kernel panic on affected NetBSD systems, leading to denial of service. It requires local attacker privileges with access to /dev/crypto and the ability to initiate a compression session. There is no indication of privilege escalation or remote exploitation. No known exploits exist in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to /dev/crypto to trusted users only and avoid using compression session types if possible. Monitor vendor channels for updates and apply patches once released.