OpenBSD 7.9: Calif publishes a working local-root exploit chaining a 37-year-old shared-memory counter overflow with a kernel use-after-free — fixed in errata 018 and 026 (syspatch)
Security firm Calif published research and full exploit code on 16 October 2026 showing local privilege escalation to root on OpenBSD 7.9 with KARL kernel relinking, SMAP and SMEP enabled, and without any information-leak bug. The chain starts with shm_nattch, the System V shared-memory attach counter, which has been a signed 16-bit short since the original 1988 BSD sources: mapping 127 segments and forking 259 processes wraps it to -32,643, and a race then frees kernel memory other processes still use. A separate out-of-bounds write corrupts multicast-membership counters so that later decrements alter page-table entries, making a user mapping supervisor-accessible; the exploit then overwrites a function pointer that sits at a predictable kernel address because OpenBSD's boot-time and best-fit allocators are not randomised. OpenBSD fixed the integer overflow in errata 018 on 14 September 2026, labelled a reliability fix, and the reference-counting use-after-free in errata 026 on 30 September, labelled a security fix; both apply to all architectures through syspatch, and OpenBSD 7.8 also received the overflow fix. No CVE has been assigned and there is no report of use in attacks. Calif also proposes kernel hardening such as safe unlinking for linked lists and allocator randomisation. Primary: OpenBSD 7.9 errata; research: Calif (16 Oct); wire: The Hacker News.
- Product
- OpenBSD kernel (System V shared memory, multicast socket handling)
- Versions
- Exploit demonstrated on OpenBSD 7.9 before errata 018 and 026; OpenBSD 7.8 also received the shmat overflow fix. No CVE assigned.
- Exploited in Australia?
- unknown
- Patch to
- Run syspatch on OpenBSD 7.9 hosts to pick up errata 018 and 026 (and the overflow fix on 7.8), then reboot. Treat this as a security update even though errata 018 is labelled a reliability fix, especially on multi-user hosts, shell servers and firewalls where local accounts exist.
Primary: OpenBSD — 7.9 errata (018 shmat integer overflow, 14 Sep 2026; 026 kernel use-after-free, 30 Sep 2026) · Vendor: Calif — Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD (16 Oct 2026) · The Hacker News — Researchers demonstrate OpenBSD root exploit chaining 37-year-old shared-memory bug