# OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old shmat(4) Integer Overflow with sysvipc Kernel Use-After-Free (No CVE Assigned)

> Calif published a proof-of-concept local root exploit for OpenBSD that chains a 37-year-old signed 16-bit shm_nattch integer overflow in shmat(4) with a reference-counting use-after-free in sysvipc and an out-of-bounds write. Patches are available via syspatch (errata 018 and 026); no in-the-wild exploitation has been documented and no CVE was assigned.

- **Published:** 2026-10-16T19:34:36Z
- **Last reviewed:** 2026-10-16T19:34:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3770
- **ID:** TL-2026-3770
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-57589

## Description

Calif researcher Andrew Griffiths disclosed on 2026-10-16 a local privilege-escalation exploit chain against OpenBSD 7.9, published as the 'Big Fish' PoC (big-fish.c, with README.md and big-fish.jpg) in the califio/publications MADBugs repository, with a full write-up at calif.io/research/big-fish. The root cause of the first bug is that the System V shared-memory attachment counter (shm_nattch) is a signed 16-bit short inherited from the original BSD sources roughly 37 years ago, with a maximum of 32,767. By mapping 127 SysV shared-memory segments (and unmapping them via munmap()) and forking 259 processes, the counter is wrapped from 32,767 to -32,643.

The wrapped counter enables a use-after-free through a race condition (shmctl IPC_RMID racing against the attach of a size-confused segment), caused by a reference-counting bug in sysvipc. The exploit performs heap grooming using sysctl(KERN_MALLOCSTATS) metrics, then aligns IP socket allocations so that a persistent 16-byte struct ip_moptions is allocated via the IP_MULTICAST_TTL (value 2) socket option. The final word of ip_moptions packs two 16-bit counters (imo_num_memberships | imo_max_memberships) at offset +12; a conditional -1 out-of-bounds write corrupts these membership fields. Closing the socket then executes atomic decrements that modify a page-table-entry (PTE) self-referential mapping, switching a mapping from user to supervisor accessible and defeating SMAP/SMEP. Finally a predictable kernel pointer is overwritten to achieve kernel code execution; the PoC restores the pointer and returns a root shell. The write-up states no information-disclosure vulnerability is required.

KARL (kernel address randomization by relinking) is bypassed because, in Griffiths' words, the kernel's memory allocators remain deterministic, so early-boot structures land at predictable addresses. OpenBSD fixed the integer overflow in errata 018 (2026-09-14, classified as a reliability fix; 7.8 and 7.9) and the reference-counting use-after-free in errata 026 (2026-09-30, a security fix; sysvipc). A related semop(2) use-after-free was fixed in errata 029 (2026-09-30, sysvsem). All are available through syspatch on all architectures. Calif reported the flaws to OpenBSD earlier in 2026 and also proposed hardening: safe-unlinking for kernel doubly-linked lists, randomizing the PTE self-map base (PML4 slots 320-448), kernel allocator randomization, an array bounds sanitizer and Alloc Tokens.

No CVE or CVSS has been assigned; severity HIGH is an analyst judgment (local root, public PoC). Separately, CVE-2026-57589 (CVSS 7.8, CWE-416; published 2026-06-25) is a distinct use-after-free in sys_semget() affecting OpenBSD through 7.9 and is related only by subsystem, not part of this chain. The sources report no evidence of exploitation in attacks and name no actor, malware, or network infrastructure.

## MITRE ATT&CK

- T1106 Native API
- T1059.004 Unix Shell
- T1082 System Information Discovery
- T1587.004 Exploits

## Sources

- [Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug](https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html)
- [Calif MADBugs OpenBSD PoC (Big Fish)](https://github.com/califio/publications/tree/main/MADBugs/openbsd)
- [Calif write-up: Big Fish](https://calif.io/research/big-fish)
- [OpenBSD 7.9 Errata](https://www.openbsd.org/errata79.html)
- [OpenBSD 7.9 errata 018 patch (shmat)](https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/common/018_shmat.patch.sig)
- [OpenBSD 7.9 errata 026 patch (sysvipc)](https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/common/026_sysvipc.patch.sig)
- [Big Fish video proof-of-concept](https://www.youtube.com/watch?v=7FO_6nwNCCs)
- [Calif blog](https://blog.calif.io/sitemap/2026)
- [Related: CVE-2026-57589 sys_semget() use-after-free (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-57589)
- [Related: OpenBSD src commit for sys_semget() use-after-free](https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3770