CVE-2026-57843

NetBSD contains an information disclosure vulnerability in mm open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth cred, filedesc, and vmspace via sysctl KERN PROC queries.