GoKawiilResearchers find 37-year-old OpenBSD kernel bug enabling root privilege escalation
Security firm Calif reported a decades-old integer overflow bug in OpenBSD's shared memory attachment counter, tracing back to original BSD source code. Combined with a separate out-of-bounds write flaw, attackers could exploit a race condition to achieve local root access even with protections like KARL, SMAP, and SMEP enabled. OpenBSD has since patched both issues through errata 026 and 018.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw's age—37 years—illustrates how deeply buried bugs can persist undetected in widely used open-source operating systems despite ongoing security audits. The exploit chain, which bypassed modern kernel protections without needing an information disclosure vulnerability, suggests that even hardened systems can remain vulnerable to sophisticated multi-step attacks combining memory corruption and race conditions.
- A 37-year-old integer overflow in OpenBSD's shared memory counter was discovered and patched this year.
- Exploiting the bug required heap grooming, race condition timing, and chaining with a separate kernel memory bug to gain root access.
- OpenBSD addressed the vulnerabilities via errata 026 and 018 after researchers from Calif reported them.
Source: calif.io, 2026-10-16
Published there as: “Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.