Security firm Calif has published a full proof-of-concept that takes a local user to root on OpenBSD 7.9. The chain starts with an integer overflow in the shmat(4) attach routine that had survived roughly 37 years in the codebase, then finishes with a reference-counting use-after-free in the kernel.
Getting there means defeating OpenBSD’s KARL kernel-address randomization plus the SMAP and SMEP hardware protections, which the writeup walks through in detail. The release came after patches shipped in September.
One patch was never labeled security
Errata 018, delivered September 14, fixed the integer overflow and was described as a reliability fix. Errata 026 followed on September 30 covering the use-after-free, flagged as security. Both arrive through syspatch across all architectures, and OpenBSD 7.8 also received the earlier overflow repair.
The framing matters for administrators. A flaw filed under reliability still turned out to be the entry point for a root exploit, so a maintenance queue that triages by advisory label would have left the first link in the chain open.
No CVE, no known attacks
Neither defect has a CVE assigned, and Calif found nothing suggesting either was used against a real target. The exploit is a research release rather than an active threat.
The takeaway is operational. If a system holds credentials or multi-user access, the errata installed two weeks ago no longer counts as done. Check syspatch, confirm both 018 and 026 are present, and stop treating reliability advisories as deferrable.
