Full Report
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped
Analysis Summary
# Vulnerability: OpenBSD 7.9 Local Root Exploit Chaining shmat(4) Integer Overflow and Reference-Counting Use-After-Free
## CVE Details
- CVE ID: Not assigned as of publication (October 16, 2026)
- CVSS Score: Not available (no CVE or vendor scoring published)
- CWE: Not stated in the article. Based on the described flaw classes, the likely weaknesses are CWE-190 (Integer Overflow or Wraparound) for the shmat(4) counter and CWE-416 (Use After Free) for the reference-counting bug. These are my inference, not confirmed by the source.
## Affected Systems
- Products: OpenBSD (kernel shmat(4) subsystem and socket/multicast handling)
- Versions: OpenBSD 7.9 is the version demonstrated in the exploit. The integer-overflow fix was also shipped to OpenBSD 7.8. The article does not state whether 7.8 is affected by the use-after-free, or whether earlier releases are affected.
- Configurations: Local user access is required. The exploit forks 259 processes and maps 127 shared-memory segments, and it relies on a race condition. The article does not describe any non-default configuration requirement.
## Vulnerability Description
- **Integer overflow (shmat(4) attach path):** The shared-memory attachment counter `shm_nattch` is a signed 16-bit `short` (max 32,767), inherited from 1988 BSD sources and never widened in OpenBSD. Mapping 127 segments and forking 259 processes pushes the counter past its maximum, wrapping it to −32,643.
- **Reference-counting use-after-free:** The corrupted reference count, combined with a race condition, causes the kernel to free memory that other processes still use.
- **Out-of-bounds write:** A separate OOB write overwrites multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, making a user-memory mapping supervisor-accessible. This bypasses SMAP and SMEP.
- **KARL bypass:** The exploit overwrites a function pointer at a predictable kernel address. KARL randomizes function and data addresses at link time, but the kernel's boot-time and best-fit allocators lack base-address randomization. Function pointers in the lo0 and enc0 network-interface handlers therefore land at the same addresses across reboots on the same hardware. No information-disclosure bug is needed.
## Exploitation
- Status: PoC available. Full proof-of-concept code is published on GitHub. The article reports no evidence of exploitation in the wild.
- Complexity: High (inferred). The chain requires a race condition, a large number of processes and segments, and two separate kernel bugs.
- Attack Vector: Local
## Impact
- Confidentiality: High. The exploit reaches kernel memory and is described as gaining root.
- Integrity: High. The exploit runs attacker code in kernel context and overwrites a function pointer.
- Availability: High (inferred). Kernel memory corruption and use-after-free can crash the system. The article does not explicitly rate availability impact.
## Remediation
### Patches
- **Errata 018** (shipped September 14, 2026): Fixes the shmat(4) integer overflow. Classified by OpenBSD as a reliability fix, not a security fix. Also shipped to OpenBSD 7.8.
- **Errata 026** (shipped September 30, 2026): Fixes the reference-counting use-after-free. Classified as a security fix. The article does not state which releases received it.
- Both are available through `syspatch` and cover all architectures.
### Workarounds
The article does not describe any workarounds. Reasonable general measures (not from the source) include:
- Apply errata 018 and 026 immediately with `syspatch`, then reboot.
- Restrict local shell and untrusted local user access on multi-user systems.
- Limit the ability of unprivileged users to create large numbers of processes, for example with login class limits (`maxproc`).
## Detection
The article provides no indicators of compromise. The following are suggestions, not vendor guidance:
- Watch for unprivileged users creating unusually large numbers of processes or shared-memory segments (`ipcs -m` for segment counts).
- Monitor for unexpected kernel panics or crashes on systems with local user access, since the exploit's race condition and memory corruption may cause instability.
- Verify patch levels with `syspatch -l` and `uname -r` against errata 018 and 026.
- Review the public PoC to build test cases for detection rules, but only in an isolated lab environment.
## References
- Source article: hxxps://thehackernews[.]com/2026/10/researchers-demonstrate-openbsd-root.html
- OpenBSD errata 018 (7.9 and 7.8 integer overflow): hxxps://www[.]openbsd[.]org/errata79.html
- Calif detailed writeup: hxxps://calif[.]io/research/big-fish
- Proof-of-concept code: hxxps://github[.]com/califio/publications/tree/main/MADBugs/openbsd
- Original BSD shm.h source (1988 origin of `shm_nattch`): hxxps://raw[.]githubusercontent[.]com/weiss/original-bsd/master/sys/sys/shm.h