A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a separate out-of-bounds write to obtain root privileges.
Calif researcher Andrew Griffiths published the “Big Fish” research on October 16, 2026, alongside public proof-of-concept code demonstrating exploitation with multiple kernel security protections enabled.
The oldest vulnerability traces to a shared memory attachment counter inherited from original BSD sources approximately 37 years ago.
That timeline describes the vulnerable code’s ancestry, not OpenBSD’s lifespan. Calif says OpenBSD addressed the two issues through errata 026 and 018, respectively.
OpenBSD Kernel Flaw
The accounting flaw involves shm_nattch, a signed 16-bit field that tracks shared memory attachments. Repeated process creation can increase the counter beyond its maximum value of 32,767, causing it to wrap into negative values.
Incorrect attachment accounting then creates conditions for a race-triggered use-after-free. Griffiths’ exploitation sequence mapped 127 System V shared memory segments, unmapped them through munmap(), and forked 259 processes.
These operations pushed the attachment count to −32,643, establishing the accounting state required for the subsequent memory corruption chain. The exploit then groomed kernel memory using allocation statistics exposed through sysctl(KERN_MALLOCSTATS).
Metrics including kb_total and kb_totalfree helped track allocation behavior and determine when fresh pages became available, improving control over the placement of targeted kernel objects.
A race between segment removal using IPC_RMID and a helper process attaching another shared memory segment enabled the next stage. Crucially, the counter overflow was not sufficient alone: exploitation also required the separately identified out-of-bounds write.
The chain targeted a 16-byte struct ip_moptions, allocated by configuring an IP socket’s multicast settings. The out-of-bounds write corrupted two membership counters. Closing the socket subsequently triggered atomic decrements against the kernel’s self-referential page-table mapping.
Those modifications changed mapping permissions, making attacker-controlled memory supervisor-accessible. Linked-list removal through TAILQ_REMOVE then supplied a write primitive that overwrote a predictable kernel pointer, redirected execution, and ultimately produced a root shell after restoring modified state.
Griffiths reported success with Kernel Address Randomized Link, Supervisor Mode Access Prevention, and Supervisor Mode Execution Prevention enabled, without an information disclosure vulnerability.
Although KARL randomizes the kernel binary, Calif found deterministic kernel allocation left early-boot structures predictably positioned across boots on identical hardware.
Administrators should prioritize the relevant OpenBSD errata rather than rely on exploit mitigations alone. This is local privilege escalation: attackers need an existing ability to execute code on the affected system; the chain does not independently provide remote access.
Calif also proposed safe-unlinking checks, randomized self-referential page-table mappings, and less predictable kernel allocation. These measures target reusable exploitation techniques, but the research does not establish their deployment in supported OpenBSD releases.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
