37 Years in the Kernel: How a Legacy BSD Integer Overflow Was Chained Into a Full OpenBSD Root Exploit
In October 2026, security firm Calif published a working local privilege escalation exploit against OpenBSD 7.9 that chains a 37-year-old signed 16-bit integer overflow in the shmat() shared-memory attachment counter with a separate kernel use-after-free, ultimately bypassing OpenBSD's KARL kernel-address randomization and hardware SMAP/SMEP protections to achieve root. The attack requires no information-disclosure vulnerability, exploiting deterministic kernel memory allocators to locate function pointers at predictable addresses. OpenBSD shipped patches in September 2026 via errata 018 and 026, available through syspatch across all architectures. No CVE was assigned and no in-the-wild exploitation has been observed. This disclosure highlights how legacy type definitions inherited across decades of BSD lineage can survive in security-hardened operating systems, and how layered exploit chains increasingly neutralize multiple independent mitigations simultaneously. The research underscores growing attacker sophistication in local privilege escalation techniques targeting hardened Unix-family kernels—a trend increasingly relevant to cloud workloads, container escape scenarios, and shared multi-tenant infrastructure.
Kill Chain
