Threat reportVulnerabilityTL-2026-3770
OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old shmat(4) Integer Overflow with sysvipc Kernel Use-After-Free (No CVE Assigned)
OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old (TL-2026-3770), also tracked as Big Fish, is a high-severity software vulnerability, first published 2026-10-16. It has no confirmed attribution, affects OpenBSD OpenBSD kernel (shmat / sysvipc / sysvsem), references 1 CVE (CVE-2026-57589), maps to 4 MITRE ATT&CK techniques (T1059.004, T1082, T1106), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-3770
- Threat ID
- TL-2026-3770
- Also known as
- Big Fish, Calif MADBugs OpenBSD
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, telecoms, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
How OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old works
Calif published a proof-of-concept local root exploit for OpenBSD that chains a 37-year-old signed 16-bit shm_nattch integer overflow in shmat(4) with a reference-counting use-after-free in sysvipc and an out-of-bounds write. Patches are available via syspatch (errata 018 and 026); no in-the-wild exploitation has been documented and no CVE was assigned.
Calif researcher Andrew Griffiths disclosed on 2026-10-16 a local privilege-escalation exploit chain against OpenBSD 7.9, published as the 'Big Fish' PoC (big-fish.c, with README.md and big-fish.jpg) in the califio/publications MADBugs repository, with a full write-up at calif.io/research/big-fish. The root cause of the first bug is that the System V shared-memory attachment counter (shm_nattch) is a signed 16-bit short inherited from the original BSD sources roughly 37 years ago, with a maximum of 32,767. By mapping 127 SysV shared-memory segments (and unmapping them via munmap()) and forking 259 processes, the counter is wrapped from 32,767 to -32,643.
The wrapped counter enables a use-after-free through a race condition (shmctl IPC_RMID racing against the attach of a size-confused segment), caused by a reference-counting bug in sysvipc. The exploit performs heap grooming using sysctl(KERN_MALLOCSTATS) metrics, then aligns IP socket allocations so that a persistent 16-byte struct ip_moptions is allocated via the IP_MULTICAST_TTL (value 2) socket option. The final word of ip_moptions packs two 16-bit counters (imo_num_memberships | imo_max_memberships) at offset +12; a conditional -1 out-of-bounds write corrupts these membership fields. Closing the socket then executes atomic decrements that modify a page-table-entry (PTE) self-referential mapping, switching a mapping from user to supervisor accessible and defeating SMAP/SMEP. Finally a predictable kernel pointer is overwritten to achieve kernel code execution; the PoC restores the pointer and returns a root shell. The write-up states no information-disclosure vulnerability is required.
KARL (kernel address randomization by relinking) is bypassed because, in Griffiths' words, the kernel's memory allocators remain deterministic, so early-boot structures land at predictable addresses. OpenBSD fixed the integer overflow in errata 018 (2026-09-14, classified as a reliability fix; 7.8 and 7.9) and the reference-counting use-after-free in errata 026 (2026-09-30, a security fix; sysvipc). A related semop(2) use-after-free was fixed in errata 029 (2026-09-30, sysvsem). All are available through syspatch on all architectures. Calif reported the flaws to OpenBSD earlier in 2026 and also proposed hardening: safe-unlinking for kernel doubly-linked lists, randomizing the PTE self-map base (PML4 slots 320-448), kernel allocator randomization, an array bounds sanitizer and Alloc Tokens.
No CVE or CVSS has been assigned; severity HIGH is an analyst judgment (local root, public PoC). Separately, CVE-2026-57589 (CVSS 7.8, CWE-416; published 2026-06-25) is a distinct use-after-free in sys_semget() affecting OpenBSD through 7.9 and is related only by subsystem, not part of this chain. The sources report no evidence of exploitation in attacks and name no actor, malware, or network infrastructure.
MITRE ATT&CK techniques used in TL-2026-3770
Execution
T1059.004 Unix Shell; T1106 Native API
Discovery
T1082 System Information Discovery
Resource Development
Affected products and versions in OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old
- OpenBSD — OpenBSD kernel (shmat / sysvipc / sysvsem)
Vulnerable versions: 7.9 before errata 018 and 026; 7.8 before errata 018
Fixed in: 7.9 with errata 018, 026, 029 (syspatch); 7.8 with errata 018 (syspatch)
Remediation for OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old
Patches
- OpenBSD 7.9 errata 018_shmat.patch.sig (2026-09-14)
- OpenBSD 7.9 errata 026_sysvipc.patch.sig (2026-09-30)
- OpenBSD 7.9 errata 029_sysvsem.patch.sig (2026-09-30)
- OpenBSD 7.8 integer overflow fix (shmat) via syspatch
Immediate actions
- Run syspatch on all OpenBSD 7.9 and 7.8 systems and reboot to load the patched kernel
- Confirm errata 018 (shmat), 026 (sysvipc) and 029 (sysvsem) are installed on 7.9
Workarounds
- No vendor workaround documented; limit untrusted local users until patched
Longer-term hardening
- Restrict local shell access on OpenBSD hosts to trusted users, since the chain requires local code execution
- Monitor for abnormal fork and SysV IPC usage on multi-user OpenBSD systems
- Track upstream hardening work: safe-unlinking, PTE self-map randomization, allocator randomization, bounds sanitizers
CVEs associated with OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old
Weaknesses (CWE) in OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old
Timeline of OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old
- NVD publishes CVE-2026-57589, a separate sys_semget() use-after-free in OpenBSD through 7.9 (related subsystem, not part of the Big Fish chain)
- OpenBSD 7.9 errata 005 addresses numerous problems in the System V (sem, msg, ipc) system call layers
- OpenBSD releases errata 018 (7.8 and 7.9) preventing integer overflow in shmat(4); classified as a reliability fix
- OpenBSD releases related errata 029 (security fix) for a semop(2) use-after-free in sysvsem
- OpenBSD releases errata 026 (security fix) for a sysvipc reference-counting bug that could lead to kernel use-after-free
- The Hacker News reports the exploit chain; no CVE assigned and no evidence of exploitation in attacks
- Calif publishes the Big Fish PoC (big-fish.c), README and write-up at calif.io/research/big-fish after patches shipped
Sources cited for OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old
- Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
- Calif MADBugs OpenBSD PoC (Big Fish)
- Calif write-up: Big Fish
- OpenBSD 7.9 Errata
- OpenBSD 7.9 errata 018 patch (shmat)
- OpenBSD 7.9 errata 026 patch (sysvipc)
- Big Fish video proof-of-concept
- Calif blog
- Related: CVE-2026-57589 sys_semget() use-after-free (NVD)
- Related: OpenBSD src commit for sys_semget() use-after-free
Detection coverage for TL-2026-3770
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3770 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.