37-Year-Old Kernel Flaw Exploited to Gain Root Access on OpenBSD — PoC Released

A proof-of-concept exploit that gains root access on OpenBSD by chaining two kernel flaws. The main bug dates back about 37 years to the original BSD source code.

According to Security researchers at Calif, the flaw survived because a shared memory attachment counter named shm_nattch used a signed 16-bit value.

OpenBSD fixed both issues before Calif published the exploit on October 16, 2026. The published research covers a local privilege escalation exploit and does not report active use in real-world attacks.

37-Year-Old OpenBSD Flaw

The first flaw affects System V shared memory handling. By repeatedly forking processes with shared memory records, a local user can push the counter beyond its maximum value of 32,767.

The number then wraps to a negative value. This integer overflow can cause a race condition that leads to a kernel use-after-free. A second flaw provides a conditional out-of-bounds write, giving the researchers enough control to turn memory corruption into root access.

Calif’s exploit maps 127 shared memory segments, removes their mappings, and forks 259 processes to force the counter to wrap. It then shapes kernel heap memory and watches allocator data through sysctl(KERN_MALLOCSTATS).

One process marks a shared memory object for removal with IPC_RMID, while a helper process tries to attach a new segment at the right time. Winning this race creates a size-confused kernel allocation.

The researchers next place IP socket objects near the freed memory and use IP_MULTICAST_TTL to create a lasting struct ip_moptions object. The out-of-bounds write changes two membership counters in this structure.

Closing the socket starts atomic counter changes that alter OpenBSD’s self-referencing page-table mapping. This makes the user-space mapping available to supervisor mode and lets the exploit overwrite a predictable kernel pointer.

The exploit then runs code in the kernel, repairs the changed pointer and opens a root shell. The chain worked with OpenBSD protections such as KARL, SMAP and SMEP enabled, without needing a separate information leak. KARL changes kernel code and data addresses at boot. However, Calif found that parts of the kernel memory allocator remain predictable on the same hardware. Early boot objects can land at stable locations, letting the exploit target the lo0 and enc0 ioctl handler pointers.

OpenBSD addressed the integer overflow in Errata 018 and the reference-counting use-after-free in Errata 026. The OpenBSD 7.9 errata page lists both fixes for all architectures. Binary updates are available through syspatch for amd64, i386 and arm64 systems. Administrators should apply every available patch and reboot so the corrected kernel becomes active.

Calif also proposed wider protection, including safe unlink checks for linked lists, random placement of the page-table map and less predictable kernel allocations. Compiler features such as array bounds checks and allocation isolation could make similar memory bugs harder to exploit.

The PoC source code is publicly available. Calif’s repository identifies the work as part of its MAD Bugs security research project.

The case shows how old design choices can remain hidden in trusted operating-system code for decades. Recently, we covered a 27-year-old OpenBSD authentication flaw and an earlier OpenBSD NFS double-free vulnerability.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post 37-Year-Old Kernel Flaw Exploited to Gain Root Access on OpenBSD — PoC Released appeared first on Cyber Security News.