NetBSD's COMPAT_NETBSD32 layer contains a use‑after‑free and double‑free flaw in the msg_recv_copyin() routine due to a missing return before the cleanup label on the success path. When a local user runs a 32‑bit binary on a 64‑bit NetBSD system and calls recvmsg() with a msg_iovlen between 9 and IOV_MAX, the kernel accesses a freed iovec buffer and then frees the same memory again. This can lead to a kernel panic or memory corruption, potentially allowing the attacker to crash the system or execute arbitrary code with kernel privileges.

Any installation of NetBSD that enables the COMPAT_NETBSD32 compatibility layer is affected. The vulnerability exists in the core kernel, so all versions of NetBSD running 32‑bit binaries on a 64‑bit machine are impacted. No specific version range is listed, but the fix applies to any current or future releases that have not yet applied the patch.

The CVSS score of 7.3 is available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires local user privileges and the ability to execute a 32‑bit binary; it may be driven using recvmsg() with a large msg_iovlen. Because it leads to a kernel panic or memory corruption, the risk is significant for systems that allow such binaries. No publicly disclosed exploits are known, but the local attack vector and high impact warrant prompt remediation.