← Sunday, October 18, 2026SecurityVulnerability

OpenBSD kernel counter overflow enabled a local root exploit

calif.io 5 min read Editor score 7/10

A signed 16-bit shared-memory attachment counter could overflow after repeated forks, contributing to a race-driven use-after-free; combined with a separate out-of-bounds write, it enabled local privilege escalation. The exploit illustrates how old kernel state and memory-safety bugs can compose into a serious failure.

What

A signed 16-bit OpenBSD shared-memory attachment counter could overflow and contribute to a local root exploit.

How

Repeated process forks wrapped the counter negative, enabling a race-related use-after-free; a separate out-of-bounds write helped escalate privileges.

Why it matters

The issues were fixed in errata 026 and 018; the case shows how a legacy counter bug can combine with kernel memory behavior to enable exploitation.

Read on calif.io → Hacker News · 66 commentsLobsters

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.