CVE-2026-32849 describes a signed integer overflow in NetBSD's cryptodev_op() function where the local signed int iov_len is assigned from an unsigned cop->dst_len. When cop->dst_len exceeds INT_MAX, this causes undefined behavior including corrupted UIO pointer arithmetic. A local attacker with low privileges and access to /dev/crypto using a compression session type can trigger a kernel panic via NULL pointer dereference if CONFIG_SVS is disabled. This vulnerability is present in NetBSD source version 0. No patch or official remediation information is currently available.

Exploitation of this vulnerability allows a local attacker with access to /dev/crypto to cause a denial of service (kernel panic) by triggering a NULL pointer dereference through integer overflow and corrupted pointer arithmetic. This results in system instability or crash but does not indicate privilege escalation or data disclosure based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to /dev/crypto and avoid enabling compression session types if possible. Additionally, ensure CONFIG_SVS is enabled as it prevents the kernel panic condition described.