Calif Publishes OpenBSD Root Exploit Built on a 37-Year-Old Counter

Calif published a local root exploit for OpenBSD on Oct. 16 (it needs an unprivileged account on a 7.9 system missing errata 018 and 026) that chains a shared-memory counter overflow with a kernel out-of-bounds write.

Andrew Griffiths wrote the Calif post, titled "Big Fish". It says the exploit returns a root shell with KARL, SMAP and SMEP enabled, and that it does not rely on an information disclosure bug. KARL relinks the kernel in a random order at each boot, while SMAP and SMEP stop the kernel reading or running user-supplied memory. The fixes shipped in September, before the write-up. OpenBSD's errata page for 7.9 lists both.

How 32,767 attachments break a counter

The counter is shm_nattch, which tracks how many processes have attached a System V shared-memory segment. It is declared as a signed 16-bit short. Forking repeatedly with attachments pushes it past 32,767, where it wraps negative. A race condition on the overflowed counter then leads to a use-after-free, a bug where the kernel keeps using memory it has already released.

Calif says the signed short traces back roughly 37 years to the original BSD sources. The post gives no affected-version range and no CVE. The errata links point to the 7.9 patch directory, so this report treats 7.9 as the release in scope.

The overflow alone does not give root. The exploit pairs it with a separate out-of-bounds write in the kernel, which the errata page lists as a different patch. Both need local access. The post describes no remote vector.

Two errata, 16 days apart

Errata	Date	Label on the errata page	Description
018	Sept. 14, 2026	Reliability fix	Prevent integer overflow in shmat(4)
026	Sept. 30, 2026	Security fix	A reference counting bug could lead to use-after-free in the kernel

The labels are the detail worth reading. Errata 018, the out-of-bounds write fix, is filed as a reliability fix, not a security fix, so an administrator who installs only the security-labelled patches would have 026 but could still miss 018. Calif's post says it reported the bugs "earlier this year", often with suggested patches, and gives no dates.

What else to patch on 7.9

Four more errata landed on Oct. 7, 2026 and are worth applying in the same pass. Errata 031 fixes multiple bugs in isakmpd(8). Errata 032 covers multiple X server vulnerabilities in the Xinput, dix, glamor, glx, present and Xkb extensions and lists 12 CVE IDs, from CVE-2026-88812 through CVE-2026-93536. Errata 033 backports libexpat 2.8.5 fixes for CVE-2026-93990. Errata 034 is a reliability fix for wscons(4).

The errata page does not say whether any of these are local or remote, and it assigns no severity scores. Neither the Calif post nor the errata page reports exploitation in the wild.

On a 7.9 machine, apply errata 018 and 026 first, then reboot into the patched kernel. For other deadlines this month, see how CISA gave agencies three days under BOD 26-04 and why a Windows mark-of-the-web bypass is already exploited.