Security researchers have published a working local privilege-escalation exploit that gains root on OpenBSD 7.9. The chain combines a 37-year-old integer overflow in shared-memory handling with a kernel use-after-free and bypasses KARL kernel-address randomization as well as SMAP and SMEP hardware protections.
Security firm Calif found and reported the issues. The company released its detailed writeup and proof-of-concept code on Thursday, Oct. 16, 2026, after OpenBSD shipped fixes, in a post titled “Big Fish” by Andrew Griffiths.
The integer overflow sits in the shmat attach path. OpenBSD inherited a signed 16-bit counter for shared-memory attachments from original BSD sources dating to 1988 and never widened the type. Researchers map 127 System V shared-memory segments, unmap them with munmap, then fork 259 processes, pushing the attachment counter past its maximum so it wraps to −32,643. A race then triggers a use-after-free.
A separate out-of-bounds write overwrites multicast-membership counters in an IP socket structure. When the socket closes, atomic decrements modify page-table entries, switching a user mapping to supervisor-accessible so the exploit can overwrite a predictable kernel pointer and run its own code.
“While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic,” Griffiths wrote. Both boot-time and best-fit allocators lack base-address randomization, so early structures with function pointers land at predictable addresses on the same hardware across reboots.
OpenBSD addressed the integer overflow in errata 018 on Sept. 14, classifying it as a reliability issue rather than a security one. The use-after-free received a security fix in errata 026 on Sept. 30. Both patches are available through syspatch and apply to all architectures; OpenBSD 7.8 also received the integer-overflow correction. Calif reported no CVE numbers assigned to either flaw and no evidence of exploitation in the wild.
The proof-of-concept succeeds with standard OpenBSD mitigations enabled and needs no separate information-leak primitive. Administrators who have not applied September errata should run syspatch and reboot.