---
title: Calif shows local root on OpenBSD 7.9 by chaining a 37-year-old signed shared-memory counter bug with a kernel out-of-bounds write | ctxsec
url: https://ctxsec.com/items/openbsd-calif-big-fish-shm
description: ""
status: "confirmed (researcher writeup + OpenBSD errata)"
published: 2026-10-16
---

> 

[← Cybersecurity News](/news) · [markdown](/items/openbsd-calif-big-fish-shm.md)

confirmed (researcher writeup + OpenBSD errata)

2026-10-16

### Calif shows local root on OpenBSD 7.9 by chaining a 37-year-old signed shared-memory counter bug with a kernel out-of-bounds write

Calif's Oct 16 'Big Fish' writeup says the SysV shared-memory attach counter has been a signed 16-bit short since the original BSD sources. Forking enough processes wraps it negative, which with a race gives a kernel use-after-free; combined with a separate conditional out-of-bounds write it yields root with KARL, SMAP and SMEP on and no info leak. Calif says the issues were fixed in OpenBSD 7.9 errata 026 (Sep 30, kernel reference-counting use-after-free) and 018 (Sep 14, integer overflow in shmat). Local privilege escalation only; there are no reports of in-the-wild use. Run `syspatch` if you haven't since September.

Sources: [Calif: Big Fish](https://calif.io/research/big-fish) · [OpenBSD 7.9 errata](https://www.openbsd.org/errata79.html) · [The Hacker News](https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html)