Big Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel Flaw
October 19, 2026 
OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available.
Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel flaws, one of them a 37-year-old integer overflow inherited from the original BSD sources. The exploit bypasses OpenBSD’s KARL address randomization and the SMAP and SMEP hardware protections without needing any information disclosure vulnerability at all.
OpenBSD already shipped patches for both issues in September: the integer overflow fix in errata 018 on September 14, and the related use-after-free fix in errata 026 on September 30. Both are available through syspatch and cover all architectures.
The shared memory attachment counter, shm_nattch, was defined as a signed 16-bit integer in BSD source code in 1988. It could hold a maximum value of 32,767. OpenBSD inherited this definition and never changed it. By mapping 127 shared memory segments and creating 259 processes through forking, an attacker can push the counter beyond its limit, causing it to wrap around to a negative value. This triggers a use-after-free vulnerability through a race condition. The corrupted counter makes the kernel free memory that other processes are still using.
The second flaw builds on the first. An out-of-bounds write overwrites multicast membership counters in the kernel. When the affected socket closes, the resulting counter updates modify page table entries, allowing user memory to be accessed with supervisor-level privileges. This bypasses SMAP and SMEP protections by exploiting errors in the kernel’s internal memory accounting, rather than directly attacking the hardware.
“One traced back roughly 37 years to the original BSD sources, where a shared memory attachment counter was defined as a signed 16-bit short. Repeatedly forking a process with shared memory attachment records could push that counter past its maximum value of 32,767, causing it to wrap to a negative value.” reads the Califs’ analysis. “This integer overflow could lead to a use-after-free via a race condition; combined with a separate out-of-bounds write in the kernel, it allowed local privilege escalation to root.”
OpenBSD’s KARL protection relinks the kernel at boot to randomize function and data addresses, which is real and meaningful hardening.
“While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic. Both the boot-time allocator and the best-fit allocator lack base address randomization.” continues the analysis. “Consequently, early boot allocations consistently land at predictable locations across boots on the same hardware.”
Early boot allocations, including function pointers in network interface handlers, land at the same addresses across every reboot on the same hardware.
That predictability is what the exploit actually uses. It targets the lo0 and enc0 interface ioctl handlers, two structures the kernel always places at known addresses, overwriting one to gain code execution and using the other to cleanly restore the overwritten pointer afterward. No information disclosure needed, no guessing required.
The researchers used kernel memory allocation metrics available through sysctl to track live allocations and detect when new pages were being created, essentially doing heap layout analysis from userland. They aligned IP socket allocations and set a multicast TTL option to a non-default value to get a persistent 16-byte structure placed where they needed it. The race condition was won by using IPC_RMID in one process while a helper process running in parallel attached a size-confused shared memory segment.
Calif researchers note there’s no evidence of either flaw being exploited in the wild, and no CVE has been assigned to either issue as of publication.
The report does more than explain the exploit. Calif suggests four security improvements that could make this attack much harder or prevent it entirely.
First, safe-unlinking for kernel linked lists checks that data structures are valid before writing to memory. If something is wrong, the kernel stops. FreeBSD and NetBSD already use this protection, but OpenBSD does not.
Second, randomizing the page table’s self-referential mapping at boot would prevent attackers from predicting which memory location to target with the decrement operation.
Third, randomizing the kernel allocator’s base address at boot would make it harder to predict function pointer locations. The researchers say this protection would have almost no performance cost.
Finally, enabling array bounds checks in release builds would detect this type of out-of-bounds write. Calif also reported 21 issues to FreeBSD that the same protection could have caught, including flaws that could allow local privilege escalation.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, OpenBSD)
