Calif Researchers Release OpenBSD Root Exploit Chaining Two Kernel Flaws
A proof-of-concept exploit chains a 37-year-old integer overflow with a use-after-free bug to bypass OpenBSD protections and gain root access.
Key points
- Calif published a local privilege escalation exploit for OpenBSD 7.9 on October 16, 2026.
- The attack chains an integer overflow in shared memory handling with an out-of-bounds write.
- OpenBSD released patches for both flaws in September 2026 via syspatch updates.
Cybersecurity firm Calif published a proof-of-concept exploit on October 16, 2026, that grants root access on OpenBSD 7.9 by chaining two kernel vulnerabilities. The exploit bypasses multiple security mechanisms without requiring an information leak, as reported by Cyber Security News.
The attack leverages a 37-year-old integer overflow inherited from original BSD source code and a separate use-after-free flaw. According to Security Affairs, both issues were patched by OpenBSD in September 2026 before the public release of the exploit code.
Technical Analysis of the Exploit Chain
The primary vulnerability involves the shared memory attachment counter, shm_nattch, which uses a signed 16-bit value. Calif researchers noted that this counter can hold a maximum of 32,767. By mapping 127 shared memory segments and forking 259 processes, an attacker forces the counter to wrap to a negative value.
This integer overflow triggers a race condition leading to a kernel use-after-free error. The exploit then utilizes a second flaw, a conditional out-of-bounds write, to corrupt multicast membership counters in the kernel. This corruption allows the attacker to modify page table entries.
The modified page tables make user-space memory accessible to supervisor mode, bypassing SMAP and SMEP hardware protections. The exploit overwrites a predictable kernel pointer to execute code and open a root shell. Calif found that parts of the kernel memory allocator remain predictable on the same hardware, allowing the exploit to bypass KARL.
Vendor Response and Patch Availability
OpenBSD addressed the integer overflow issue in Errata 018, released on September 14, 2026. The related reference-counting use-after-free vulnerability was fixed in Errata 026 on September 30, 2026. Both patches are available through the syspatch utility and cover all supported architectures.
The published research covers a local privilege escalation scenario and does not report active use in real-world attacks. However, the availability of working proof-of-concept code increases the risk for unpatched systems. Administrators should verify their patch status immediately.
What should you do?
System administrators running OpenBSD 7.9 should check for and apply Errata 018 and Errata 026 immediately. Monitor system logs for unusual process forking or shared memory activity that could indicate exploitation attempts. Review access controls to limit local user capabilities where possible.
What to do and how to stay safe: OpenBSD
- Verify that OpenBSD 7.9 systems have applied Errata 018 and Errata 026 via syspatch.
- Monitor kernel logs for unexpected shared memory segment creations or process forks.
- Restrict local user permissions to minimize the impact of potential privilege escalation.
- Review network configurations to limit exposure to untrusted local users.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What OpenBSD versions are affected by this exploit?
The exploit targets OpenBSD 7.9, as stated in the Calif report.
Are patches available for these vulnerabilities?
Yes, OpenBSD released patches in Errata 018 and Errata 026 in September 2026.
Is this vulnerability being exploited in the wild?
No, the research does not report active use in real-world attacks.
