OpenBSD 7.9 errata close kernel bugs Calif chained into a local root exploit

Security firm Calif has published research describing how it obtained root privileges on OpenBSD by combining two kernel flaws that the project has since patched. In a write-up by Andrew Griffiths dated October 16, the company said one of the bugs can be traced back roughly 37 years to the original BSD sources. Calif said it reported the vulnerabilities to OpenBSD earlier this year, often together with proposed patches.

According to Calif, the older flaw concerns a counter that tracks shared memory attachments and was defined as a signed 16-bit value, which can overflow. The firm said this overflow could lead to a use-after-free through a race condition and, together with a separate out-of-bounds write in the kernel, allowed a local user to escalate to root. Calif said the attack worked with OpenBSD's KARL kernel relinking and the SMAP and SMEP processor protections enabled, and did not require an information disclosure bug. The write-up also links to code and a proof of concept.

Calif said the issues were addressed in OpenBSD errata 018 and 026. On the OpenBSD 7.9 errata page, 018 is dated September 14, 2026 and is listed as a reliability fix that prevents an integer overflow in shmat. Errata 026, dated September 30, 2026, is listed as a security fix for a reference counting bug that could result in a use-after-free condition in the kernel. Both entries apply to all architectures. Calif names both errata as the fixes for the issues in its chain, so one of the two fixes carries a reliability label rather than a security label.

The errata page states that patches are distributed as signed unified diffs, and that the syspatch utility can install binary updates on amd64, i386 and arm64. Fixes for supported releases are also folded into the -stable branch, which the project maintains for one year after a release. Calif describes the exploit as a local privilege escalation, meaning an attacker would first need access to the system.

Beyond the errata, Calif outlined several hardening ideas aimed at making similar attack paths harder. These include integrity checks before entries are removed from doubly linked lists, which the firm noted FreeBSD and NetBSD already implement, and more randomization of kernel memory, since Calif said OpenBSD's kernel allocators remain deterministic even though KARL randomizes the kernel binary layout. The firm also pointed to compiler features such as the array bounds sanitizer and the upcoming Alloc Tokens. Calif said it had suggested the sanitizer to FreeBSD and privately reported 21 issues there that it would have caught, arguing that mitigating whole bug classes grows more important as AI assists vulnerability discovery.