OpenBSD Root Exploit Leverages 37-Year-Old Vulnerability

• •The exploit targets OpenBSD 7.9, leveraging a 37-year-old integer overflow.
• •Patches for the vulnerabilities were released in September 2026, but a PoC exploit is now public.
• •No CVEs have been assigned for the vulnerabilities, and there is no evidence of active exploitation.

Security firm Calif has demonstrated a local privilege escalation exploit on OpenBSD 7.9 by chaining a 37-year-old integer overflow in the shared-memory subsystem with a kernel use-after-free. This exploit bypasses OpenBSD's KARL kernel-address randomization and SMAP/SMEP hardware protections. The vulnerabilities were fixed in September 2026, with the integer overflow patched in errata 018 on September 14 and the use-after-free in errata 026 on September 30. Despite the patches, a proof-of-concept exploit has been published, and no CVEs have been assigned for these flaws. The exploit maps 127 shared-memory segments and forks 259 processes to wrap the shared memory attach count, leading to a race condition that triggers the use-after-free. The exploit does not require an information disclosure vulnerability and can gain root access without prior exploitation evidence.