Public exploit takes root on OpenBSD 7.9 through a bug that shipped as a reliability fix
Calif published a working exploit that gets root on OpenBSD 7.9 past KARL, SMAP and SMEP by chaining two flaws patched on September 14 and 30. Neither flaw has a CVE, and The Hacker News reports no evidence of attacks.
The Watch · Security desk
Key figures: the exploit wraps the shm_nattch counter to -32,643; its maximum as a signed 16-bit short is 32,767; to get there the exploit forks 259 processes and maps 127 shared-memory segments.
| Figure | Value | Note | Claim |
|---|---|---|---|
| shm_nattch after the exploit wraps it | −32,643 counter value | 9 | |
| Counter maximum (16-bit) | 32,767 counter value | 8 | |
| Processes forked | 259 processes | 9 | |
| Segments mapped | 127 segments | 9 |
What happened
- The exploit maps 127 shared-memory segments and forks 259 processes, wrapping the shm_nattch counter from its 32,767 maximum to -32,643.
- A race condition then triggers a use-after-free, because the corrupted reference count makes the kernel free memory that other processes still use.
- A separate out-of-bounds write corrupts multicast-membership counters, and the decrements on socket close edit page-table entries to bypass SMAP and SMEP.
- With that done, the exploit overwrites a function pointer at a predictable kernel address and runs its own code.
- Both errata install through syspatch on all architectures, and OpenBSD 7.8 also received the integer-overflow fix.
Why it matters
- Who's exposed exposure OpenBSD 7.9 hosts that give shell accounts to other users or run untrusted code, and lack errata 018 and 026, have a published local route to root.
- Who has to decide decision A patch queue that applies only security-labeled errata would skip 018, the entry point for the chain.
- What it limits constraint The errata fix two bugs. Calif's four hardening proposals, including kernel-allocator randomization, are separate changes to OpenBSD's kernel.
Next story · Security · 3d ago
Installing MarkLogic's August fixes leaves 31 newer flaws openConfirmed2 publishers
The KARL bypass comes from the allocators. "While OpenBSD's KARL relinks the kernel binary to randomize both function and data addresses, the kernel's memory allocators remain deterministic," researcher Andrew Griffiths wrote [14]. Neither the boot-time nor the best-fit allocator randomizes a base address [15]. On a given machine, structures set up early in boot sit at identical addresses every time it restarts, and that includes function pointers in the handlers for the lo0 and enc0 network interfaces [15]. So the exploit works without any information-leak bug [15].
OpenBSD shipped the use-after-free fix 16 days after the overflow fix [17]. Calif said it reported the flaws to OpenBSD "earlier this year" [11]. The source does not give a month. The proof-of-concept code is on GitHub [11].
This is a local privilege escalation [1]. The attacker needs code running on the machine first. In our view, a host where only administrators log in gains little new exposure. A host that hands shell accounts to other people, or runs code it does not control, now has a published path from an unprivileged user to root.
The oldest link is a type choice. The shm_nattch counter is a signed 16-bit short with a maximum of 32,767 in BSD sources dating to 1988 [8]. OpenBSD inherited the type and never widened it [8]. Calif's first hardening proposal, safe-unlinking for kernel linked lists, is already used by FreeBSD and NetBSD [16].
What to watch
- Whether a CVE is assigned to either flaw; The Hacker News reports none as of publication.
- Whether anyone reports exploitation now that Calif's proof-of-concept code is on GitHub.
- Whether OpenBSD adopts any of Calif's four hardening proposals, such as allocator randomization.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A local privilege escalation exploit gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing KARL kernel-address randomization and SMAP and SMEP hardware protections.
- [2]
Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped patches for both issues in September.
- [3]
The integer overflow in the shmat(4) attach function was fixed in errata 018, shipped September 14 as a reliability fix.
- [4]
The reference-counting use-after-free that completes the chain was fixed separately in errata 026, shipped September 30 as a security fix.
- [5]
Both errata are available through syspatch and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix.
- [6]
The integer overflow, the entry point for the full chain, is classified as a reliability fix, not a security fix.
- [7]
No CVE has been assigned for either flaw as of publication, and there is no evidence that the vulnerabilities have been used in attacks.
- [8]
The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short with a maximum value of 32,767 in original BSD sources dating to 1988; OpenBSD inherited the type and never widened it.
- [9]
The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum and wrapping it to -32,643.
- [10]
A race condition then triggers a use-after-free: the corrupted reference count causes the kernel to free memory that other processes still use.
- [11]
Calif said it reported the flaws to OpenBSD "earlier this year." The proof-of-concept exploit code is available on GitHub.
- [12]
A separate out-of-bounds write overwrites multicast-membership counters in the kernel; when the affected socket closes, the resulting decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP.
- [13]
The exploit then overwrites a function pointer at a predictable kernel address to run its own code.
- [14]
"While OpenBSD's KARL relinks the kernel binary to randomize both function and data addresses, the kernel's memory allocators remain deterministic," researcher Andrew Griffiths wrote.
- [15]
Both the boot-time and best-fit allocators lack base-address randomization, so early-boot structures, including function pointers in the lo0 and enc0 network-interface handlers, land at the same addresses across reboots on the same hardware. The exploit needs no information-disclosure vulnerability.
- [16]
Beyond the two errata, Calif proposes four categories of hardening: safe-unlinking for kernel linked lists (already used by FreeBSD and NetBSD), randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.
- [17]
Errata 026 shipped 16 days after errata 018.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toResearchers show how two vulnerabilities in OpenBSD 7.9 could grant full administrator privileges
1 article · October 16, 2026
- thehackernews.comResearchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
1 article · October 16, 2026
Topics and entities
Topics
- Vulnerability Disclosure
- Privilege Escalation
- Operating system security
Entities
- OpenBSD
- Andrew Griffiths
- Calif
- The Hacker News