Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

Swati KhandelwalOct 16, 2026Vulnerability / OpenBSD

A recent local privilege escalation exploit has been discovered on OpenBSD 7.9, bypassing various kernel protections. The exploit chain combines a decades-old integer overflow with a kernel flaw, exploiting vulnerabilities that OpenBSD patched in September after being reported by security firm Calif.

The initial integer overflow issue in the shmat(4) attach function was addressed in errata 018, released on September 14 as a reliability fix. Subsequently, errata 026 was issued on September 30 to fix a reference-counting use-after-free bug that completed the exploit chain.

Both patches are available through syspatch for all architectures, including OpenBSD 7.8. Despite the severity of the exploit, it was classified as a reliability fix rather than a security fix.

While no CVEs have been assigned to these vulnerabilities, there is currently no evidence of them being actively exploited in the wild.

The exploit takes advantage of the shared-memory attachment counter shm_nattch, which has a maximum value of 32,767. By manipulating this counter through a series of actions, the exploit triggers a use-after-free condition, allowing it to gain root access on the system.

In addition to the technical details of the exploit, Calif also proposes several hardening measures for OpenBSD, including safe-unlinking for kernel linked lists, randomization of page-table mappings, kernel-allocator randomization, and compiler-based bounds checking.

Calif reported these vulnerabilities to OpenBSD earlier in the year and has made the proof-of-concept exploit code available on GitHub for further analysis.