The vulnerability stems from a race condition in the cryptodev_op() function of the NetBSD OpenCrypto subsystem, allowing a local attacker to trigger a double‑free by submitting concurrent CIOCCRYPT operations on the same session identifier. The double‑free corrupts kernel heap memory, potentially leading to a crash or escalation of privileges to the kernel level. This weakness is classified as a concurrency flaw (CWE‑362) and a double‑free vulnerability (CWE‑415).

Any NetBSD version before the commit ec8451efc1565516aba9e7047e1a1a1ce7953a2f in the NetBSD:src repository is vulnerable. The issue resides in the cryptodev component of the OpenCrypto subsystem.

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires a local user with the ability to issue encrypted operations on an SMP system concurrently on the same cryptographic session. Successful exploitation would corrupt kernel memory, potentially enabling privilege escalation or denial of service. Given the local nature and requirement for concurrent requests, the attack is not trivial but feasible for a privileged local attacker.