Local Privilege Escalation Chain Gains Root on OpenBSD 7.9
Security firm Calif published proof-of-concept exploit code on October 16, 2026, demonstrating a local privilege escalation exploit that chains a 37-year-old integer overflow with a separate kernel flaw to gain root access on OpenBSD 7.9. The exploit successfully bypasses OpenBSD’s kernel-address randomization (KARL) as well as supervisor-mode execution prevention (SMEP) and supervisor-mode access prevention (SMAP) hardware protections, The Hacker News reported.
The entry point for the attack originates in legacy Unix code. The shared-memory attachment counter, known as `shm_nattch`, is defined as a signed 16-bit short with a maximum value of 32,767 in original BSD sources dating back to 1988. OpenBSD inherited this data type and never widened it across subsequent releases. To trigger the overflow, the exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum limit and wrapping it around to −32,643, according to The Hacker News and The Daily Tech Feed.
Chaining the Integer Overflow and Use-After-Free Defect
Once the integer counter wraps around, a race condition triggers a reference-counting use-after-free defect. The corrupted reference count causes the kernel to free memory blocks while other processes are still actively using them. Calif documented this interaction as the first half of the exploit chain. To achieve write access inside kernel memory, the exploit relies on a separate out-of-bounds write.
After shaping the kernel heap and inspecting allocator state, the exploit wins a precise race between removing a shared-memory segment and attaching a replacement segment. This process creates size confusion, allowing nearby IP socket objects to occupy the incorrectly freed memory space. The exploit then corrupts internal socket structures via `IP_MULTICAST_TTL` and modifies page-table mappings, switching a user-memory mapping to be supervisor-accessible to bypass SMAP and SMEP protections, as Zeli noted in its technical breakdown.
Bypassing Kernel-Address Randomization via Deterministic Allocators
Although OpenBSD utilizes KARL to relink the kernel binary and randomize function and data addresses, the underlying kernel memory allocators remain deterministic. Researcher Andrew Griffiths wrote that both the boot-time and best-fit allocators lack base-address randomization. Consequently, early-boot structures, including function pointers in the `lo0` and `enc0` network-interface handlers, land at identical addresses across reboots on the same hardware. The exploit requires no information-disclosure vulnerability to locate these targets, overwriting a predictable kernel function pointer to execute its own code.
Emergency Errata and System Patch Deployment
OpenBSD shipped patches addressing both underlying vulnerabilities in September 2026. The integer overflow in the `shmat(4)` attach function was fixed in errata 018, which shipped on September 14, 2026, as a reliability fix. The reference-counting use-after-free that completes the attack chain was fixed separately in errata 026 on September 30, 2026, designated as a security fix. Both updates cover amd64, i386, and arm64 architectures. Administrators apply these updates through `syspatch` and reboot machines to load the corrected kernel.
Proposed Kernel Hardening and Defensive Countermeasures
Beyond applying the September errata, Calif proposed four primary categories of kernel hardening to prevent similar legacy vulnerabilities. These recommendations include implementing safe-unlinking for kernel linked lists—a protection already utilized by FreeBSD and NetBSD—randomizing the page-table self-referential mapping, introducing kernel-allocator randomization, and enforcing compiler-based bounds checking. Calif reported the flaws to OpenBSD earlier in 2026 and confirmed there is no evidence of the exploit being used in attacks prior to public disclosure.
Keep reading