Full Details and PoC Exploit Released for 37-Year-Old OpenBSD Kernel Bug That Grants Root
Do Son 
TL;DR
On October 16, 2026, Calif published full technical details and working proof-of-concept code for “Big Fish,” an OpenBSD kernel vulnerability chain. The chain gives a local user root on OpenBSD 7.9, even with KARL, SMAP and SMEP enabled. OpenBSD has already fixed both bugs through errata patches.
Why It Matters
OpenBSD has a strong reputation for security. Yet the core bug in this chain is roughly 37 years old. According to Calif, it “traced back roughly 37 years to the original BSD sources, where a shared memory attachment counter was defined as a signed 16-bit short.”
The exploit also needs no separate information leak. That makes this local privilege escalation more practical than many kernel attacks.
Details and exploit code are now public
Calif’s Big Fish research write-up explains the full exploit path. In addition, the team posted the complete PoC exploit code on GitHub. As a result, anyone can now study or reuse it against unpatched systems.
How the Attack Works
The OpenBSD kernel vulnerability chain combines two bugs. First, the 16-bit shared memory counter can overflow and wrap to a negative value. That overflow can lead to a use-after-free through a race condition. Second, a separate out-of-bounds write in the kernel finishes the job.
Together, Calif says, they “allowed local privilege escalation to root.” The attacker must already run code on the machine.
Calif also points to a design weakness. “While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic,” wrote researcher Andrew Griffiths.
Exploitation status
A public PoC exists. However, no source reports exploitation in the wild. No CVE IDs have been assigned, The Hacker News reported.
Affected Versions
The flaws affect OpenBSD 7.9 systems without the latest errata. According to The Hacker News, OpenBSD 7.8 also received one of the fixes.
Patch and Mitigation Steps
- Apply OpenBSD 7.9 errata 018 and 026 by running syspatch.
- Reboot after patching so the new kernel loads.
- Limit local shell access on shared OpenBSD hosts.
Beyond the patches, Calif proposes deeper fixes. These include safe-unlinking checks, a randomized page table map and a less predictable kernel allocator. With working code public, admins should not delay this OpenBSD kernel vulnerability fix. Calif warns that “in the age of AI-assisted vulnerability discovery,” hardening against whole bug classes matters more than ever.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
