Calif Publishes OpenBSD Local Root Escalation PoC

Calif researcher Andrew Griffiths published an OpenBSD root PoC on October 16—the source code and technical description of a demonstration of local privilege escalation to root. According to the author, the chain can obtain the highest privileges even on a system with KARL, SMAP and SMEP enabled. However, this is not remote takeover: an attacker must already be able to run local code on the target system.

The PoC combines two kernel bugs related to SysV shared memory. OpenBSD issued fixes for them before the research was published. Administrators should therefore verify that the relevant errata or current system updates have been applied.

OpenBSD root PoC Chains Two Kernel Bugs

In its technical material, Calif states that the chain combines an overflow of the SysV shared-memory attachment counter with another out-of-bounds kernel write bug. According to the author, the combination can lead to local root privilege escalation.

The first relevant fix is listed as erratum 018 for OpenBSD 7.9. The project issued it on September 14, 2026, addressing an integer overflow in the shmat(4) interface. The second erratum, number 026, followed on September 30. It concerns a reference-counting bug that could result in a use-after-free in the kernel.

Public disclosure of the source code means that the chain’s technical details are available beyond the original research environment. The risk therefore primarily affects unpatched systems on which an attacker can already run a local program.

What OpenBSD Administrators Should Verify

The first step is to check whether the system includes fixes from errata 018 and 026, or whether it has been updated to the current security-patch level. The scope of potentially affected installations depends precisely on whether the particular machine received the patch or system update.

• Verify that erratum 018 has been applied; it fixes an integer overflow in shmat(4).
• Verify that erratum 026 has been applied for the reference-counting bug with a possible use-after-free in the kernel.
• Prioritize machines on which untrusted users or processes may run local code.

KARL, SMAP and SMEP are hardening mechanisms intended to make it more difficult to exploit bugs in the kernel’s handling of memory. According to the author, the published OpenBSD root PoC demonstrates that enabling them alone did not prevent chaining these two specific vulnerabilities. This does not mean that the mechanisms do not work or were disabled; Calif states that it successfully obtained root access in a configuration where they were enabled.

No Confirmed Exploitation in the Wild

The editorial team has not independently verified the PoC’s reproducibility. The supplied material also contains no evidence that the listed bugs have been exploited in real-world attacks. It is therefore a publicly described local privilege-escalation technique, not a confirmed campaign against OpenBSD users.

Further developments may bring additional CVE identifiers or a more precise definition of the affected versions from OpenBSD or Calif. Independent confirmation that the demonstration works, as well as any reports of exploitation, should also be monitored. Calif also mentions possible additional kernel-hardening changes, such as allocation randomization.

Verified and updated: October 17, 2026 06:24