Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

Researchers from security firm Calif have published a local privilege escalation exploit targeting OpenBSD 7.9 that achieves root access by chaining a roughly 37-year-old integer overflow in shared memory with a separate kernel flaw. The exploit successfully bypasses OpenBSD's KARL (kernel address randomization layout) as well as hardware protections SMAP and SMEP. A full proof-of-concept code was released after OpenBSD shipped a patch. The vulnerability chain demonstrates that legacy bugs in foundational OS code can remain exploitable for decades. This is particularly notable given OpenBSD's reputation as one of the most security-focused operating systems. The attack is local, requiring existing access to the system, but escalates privileges to root. The disclosure follows responsible reporting by Calif to the OpenBSD team prior to public release.