# OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and ip_moptions Out-of-Bounds Write Chain Enables Local Privilege Escalation to Root (Public PoC)

> A two-stage OpenBSD kernel exploit chain, published as 'Big Fish' by researcher Andrew Griffiths (Calif) on 2026-10-16, combines a 37-year-old signed 16-bit System V shared-memory attachment counter (shm_nattch) integer overflow/use-after-free with an out-of-bounds write affecting struct ip_moptions to reach root on OpenBSD 7.9, reportedly bypassing KARL, SMAP and SMEP. Public PoC code is available; OpenBSD addressed the shared-memory issues via errata 018 and 026.

- **Published:** 2026-10-17T12:57:09Z
- **Last reviewed:** 2026-10-17T12:57:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3804
- **ID:** TL-2026-3804
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Big Fish is a local privilege escalation (LPE) research chain against the OpenBSD kernel, published by Andrew Griffiths of Calif on 2026-10-16 alongside proof-of-concept code (big-fish.c, hosted in the califio/publications GitHub repository under MADBugs/openbsd/). The researcher states the root cause traces back roughly 37 years to original BSD source code: the System V IPC shared-memory attachment counter, shm_nattch, is declared as a signed 16-bit short in sys/sys/shm.h. Repeated attach/detach and process-fork activity can drive this counter past its signed maximum, causing it to wrap to a large negative value. Combined with a reference-counting error, this produces a use-after-free condition in the kernel's SysV IPC shared-memory subsystem. The flaw was reported to the OpenBSD project earlier in 2026, ahead of public disclosure.

At a high level, the published research describes a multi-stage chain rather than a single bug: (1) the shared-memory attachment counter is driven to overflow through repeated mapping/unmapping and process forking, producing a reference-count/use-after-free primitive; (2) kernel heap state is profiled using sysctl(KERN_MALLOCSTATS) statistics to infer allocator behavior, which is feasible because the OpenBSD kernel allocator is deterministic; (3) a timing race between object deallocation (IPC_RMID) and reattachment by a helper process is used to achieve a type/size confusion over freed kernel memory; (4) the confused memory is overlaid with an IP multicast socket option structure (struct ip_moptions, 16 bytes) created via setsockopt(IPPROTO_IP, IP_MULTICAST_TTL, ...); (5) a conditional out-of-bounds write corrupts fields within that structure; (6) subsequent socket teardown operations that walk the multicast group list provide a controlled write primitive against adjacent kernel memory, which is leveraged to corrupt a self-referential page-table-entry mapping and flip a page from user- to supervisor-writable; (7) this is used to overwrite a predictable kernel code/data pointer and obtain a root shell. The researcher reports this chain defeats OpenBSD's KARL (kernel address randomized link), SMAP, SMEP and ASLR protections on OpenBSD 7.9 (and potentially earlier releases sharing the same SysV IPC and multicast code paths).

This is strictly a local privilege escalation: an attacker requires pre-existing code execution (e.g., an unprivileged local shell, a compromised service account, or a sandboxed/jailed process capable of IPC and socket syscalls) on the target host; it grants no remote access or initial foothold on its own. No CVE identifier, CVSS score, or indicators of in-the-wild exploitation are present in any source reviewed; the HIGH severity in this record is an analyst assignment reflecting root-level local privilege escalation with a working public PoC, not a vendor- or NVD-assigned rating. No network-based IOCs exist for this threat since it is a local kernel exploit; the IOCs captured below are host/behavioral artifacts, file/code artifacts, and vulnerable-component identifiers useful for detection and asset inventory.

OpenBSD published two relevant errata for the 7.9 release: errata 018 (dated 2026-09-14, patch file 018_shmat.patch.sig, described by OpenBSD as a reliability fix to 'prevent integer overflow in shmat(4)', applicable to all architectures) and errata 026 (dated 2026-09-30, patch file 026_sysvipc.patch.sig, described by OpenBSD as a security fix for 'a reference counting bug [that] could lead to use-after-free in the kernel', applicable to all architectures). The researcher's own write-up cites exactly these two errata as addressing the shared-memory side of the chain; neither official errata description specifically mentions IP multicast or ip_moptions, so it is not confirmed by the sources reviewed whether the ip_moptions out-of-bounds-write primitive used in the later exploitation stages was independently patched or whether it was an exploitation technique riding on the same freed-memory condition. Defenders running affected OpenBSD releases should treat applying both errata as the primary remediation rather than relying on exploit mitigations such as KARL/SMAP/SMEP alone, per the original source's guidance. The researcher additionally proposes forward-looking kernel hardening not yet implemented upstream at time of writing: safe-unlinking for kernel doubly-linked lists, randomization of the self-referential page-table-entry mapping (e.g., via .openbsd.randomdata-style techniques), randomization of kernel allocator base addresses and allocation order, and compiler-based defenses such as array-bounds sanitizers and allocation-tagging ('Alloc Tokens') schemes.

## MITRE ATT&CK

- T1211 Exploitation for Stealth
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1106 Native API
- T1082 System Information Discovery

## Sources

- [OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root](https://gbhackers.com/openbsd-kernel-flaw/)
- [Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD (research write-up)](https://calif.io/research/big-fish)
- [califio/publications — MADBugs/openbsd/big-fish.c (PoC source)](https://github.com/califio/publications/tree/main/MADBugs/openbsd/big-fish.c)
- [OpenBSD 7.9 Errata 018 — shmat(4) integer overflow fix](https://www.openbsd.org/errata79.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3804