OpenBSD root chain turns a reliability fix into LPE
Calif published proof-of-concept code for a local OpenBSD 7.9 root exploit that chains two bugs: a 37-year-old integer overflow in shmat(4) and a separate kernel use-after-free. OpenBSD had already shipped fixes in errata 018 and errata 026, with the first landing September 14 as a reliability fix and the second on September 30 as a security fix.
The chain starts by overflowing the shared-memory attachment counter until the kernel miscounts live mappings, then uses that bad state to reach memory the kernel still needs. From there, a second flaw lets the exploit flip page-table behavior and reach code execution as root, even with KARL, SMAP, and SMEP in place.
For OpenBSD 7.9 and 7.8 operators, the lasting issue is that the shmat bug is not just a stability problem when paired with the later kernel bug. If a host accepts local users or untrusted workloads, treating errata 018 as non-security leaves part of the attack path in place.