CVE-2026-57843 is an information disclosure vulnerability in NetBSD's mm_open() function within sys/dev/mm.c. The issue arises because world-accessible devices like /dev/null and /dev/zero are incorrectly assigned the PK_KMEM process flag. This misconfiguration allows unprivileged local users to bypass the CANSEE_KPTR kernel pointer obfuscation mechanism and read real kernel virtual addresses. Sensitive kernel structures such as struct proc, kauth_cred, filedesc, and vmspace can be accessed via sysctl KERN_PROC queries. The vulnerability affects NetBSD versions >=9.0 <9.5 and >=10.0 <=10.1. No known exploits are reported in the wild. The CVSS 4.0 score is 6.8, reflecting a medium severity local attack with low complexity and no user interaction required.

Unprivileged local users can obtain real kernel virtual addresses, bypassing kernel pointer obfuscation protections. This information disclosure could aid attackers in further attacks that rely on knowledge of kernel memory layout. However, the vulnerability does not allow privilege escalation or remote exploitation directly. The impact is limited to local information disclosure of sensitive kernel structures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict local access to the affected devices and consider limiting access to sysctl KERN_PROC queries to trusted users only.