NetBSD’s mm_open() in sys/dev/mm.c incorrectly applies the PK_KMEM process flag to world‑accessible device files. This allows an unprivileged local user to bypass the CANSEE_KPTR obfuscation mechanism and obtain real kernel virtual addresses. The exposed addresses can be used to read sensitive kernel structures such as struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries. The weakness is an access‑control flaw identified as CWE‑732.

The vulnerability affects the NetBSD Foundation’s NetBSD operating system. The attack surface includes standard device files like /dev/null and /dev/zero, which are typically world‑accessible and therefore susceptible to the mis‑flagging issue.

Risk remains moderate with a CVSS score of 6.8 and a lack of an EPSS rating. The flaw is not listed in the CISA KEV catalog. Because the exploit requires only local, or local shell can potentially trigger the information disclosure. Exploiting the vulnerability does not grant code execution or elevated privileges but provides insight into kernel memory that could aid further attacks.