OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root
Researchers published a local OpenBSD kernel exploit chaining a decades-old shared-memory bug with an out-of-bounds write to gain root.
Researcher Andrew Griffiths published “Big Fish” on October 16, 2026, with public proof-of-concept code for a local OpenBSD kernel exploit that obtains root. The chain combines a shared-memory attachment counter inherited from early BSD code, which can wrap and lead to a use-after-free, with a separate out-of-bounds write. Testing reportedly succeeded with Kernel Address Randomized Link, SMAP, and SMEP enabled and without an information leak. OpenBSD addressed the issues in errata 026 and 018; an attacker must already be able to run code locally.
- Public proof-of-concept gains local root by chaining two kernel bugs.
- A signed 16-bit shared-memory attachment counter can wrap and enable a use-after-free.
- A separate out-of-bounds write is required; the chain bypasses KARL, SMAP, and SMEP in testing.
- OpenBSD issued errata 026 and 018; the issue is local only, not remote access.
From the original article
2 min read at gbhackers.com
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a separate out-of-bounds write to obtain root privileges. Calif researcher Andrew Griffiths published the “Big Fish” research on October 16, 2026, alongside public proof-of-concept code demonstrating exploitation with multiple kernel security protections enabled. The oldest vulnerability traces to a shared memory […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.