To determine whether an OpenBSD machine is exposed, verify its release and architecture, inspect the patches installed with syspatch -l, and compare that state with the release errata. For OpenBSD 7.8, the host is not remediated until both the September 14, 2026 shmat(4) integer-overflow fix and the September 30, 2026 kernel reference-counting/use-after-free fix are installed, followed by a reboot. If either correction is absent, continue treating the machine as exposed.
What this OpenBSD bug is
The vulnerability starts in the System V shared-memory interface, specifically the attachment accounting used by shmat(4). A counter inherited from the original BSD design is a signed 16-bit short. Its highest positive value is 32,767. Under a carefully arranged sequence of shared-memory operations and process forks, the value can pass that limit and wrap to a negative number.
As an Amazon Associate I earn from qualifying purchases.
That wrap makes the kernel’s accounting disagree with the objects and processes that actually exist. The resulting race can produce a use-after-free. Calif researcher Andrew Griffiths demonstrated a local privilege-escalation chain that combined this accounting error with a separate kernel out-of-bounds write. The demonstrated result was execution of kernel code as root.
What the published exploit did
The setup described by Griffiths mapped 127 System V shared-memory segments, removed the mappings with munmap(), and forked 259 processes. That activity wrapped the attachment count to -32,643. The exploit then used heap grooming, a race involving IPC_RMID, socket allocation, and a corrupted multicast-membership counter. Those conditions were used to change page-table permissions and reach kernel code execution.
#1 Best Overall
The chain bypassed kernel address randomization (KARL), Supervisor Mode Access Prevention (SMAP), and Supervisor Mode Execution Prevention (SMEP) in the tested environment. It depended on deterministic placement by the kernel memory allocator. Those details explain why the issue is a local kernel-security problem rather than a remotely reachable network-service flaw.
Which fixes must be present
OpenBSD 7.8’s errata identify two separate corrections relevant to the demonstrated chain. Both apply to all architectures listed in those entries.
| Errata date | Errata description | Why it matters |
|---|---|---|
| September 14, 2026 | “Prevent integer overflow in shmat(4).” | Stops the shared-memory attachment counter from overflowing. |
| September 30, 2026 | “A reference counting bug could lead to use-after-free in the kernel.” | Corrects the kernel lifetime-management bug used later in the demonstrated chain. |
These are independent checks. Installing only the shmat(4) correction is not enough if the reference-counting correction is missing, and the reverse is also true. For the documented chain, the practical decision is binary: both fixes installed and the machine rebooted means the chain is remediated; either fix missing means the host remains exposed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What about OpenBSD 7.9?
The cited errata entries specifically document OpenBSD 7.8. Do not infer 7.9’s status from the version number alone. Run the same release and patch audit on a 7.9 host, then consult the 7.9 errata for entries addressing the shmat(4) integer overflow and the kernel reference-counting/use-after-free. Until the corresponding corrections for that release are confirmed in the installed patch list, use the safer operational classification: exposed.
Step 1: Record the running release and architecture
Run these commands on the machine being assessed:
uname -r
machineuname -r reports the running OpenBSD release. The machine command identifies the hardware architecture. Record both values exactly; patch applicability is tied to the release and architecture, and a system can have a different kernel on disk from the one currently running if it has not been rebooted after maintenance.
- Run the commands locally or through an authenticated administrative session.
- Save the output with the host name and assessment time so that you can compare machines consistently.
- Do not classify a host from a package inventory or from a service banner; this is a kernel release-and-patch question.
Step 2: List installed system patches
Display the patches recorded by OpenBSD’s system-patch utility:
syspatch -lThe command lists installed system patches for the running release. Read the output together with the release errata, rather than guessing from a patch number or from the date of the last maintenance window. The errata title and date are the authoritative way to identify the two corrections.
How to match the list to the errata
- Confirm that the release from
uname -ris the release whose errata you are consulting. - Check for the system patch that corresponds to the entry titled “Prevent integer overflow in shmat(4).” For OpenBSD 7.8, the entry is dated September 14, 2026.
- Check separately for the patch corresponding to “A reference counting bug could lead to use-after-free in the kernel.” For OpenBSD 7.8, that entry is dated September 30, 2026.
- Verify that the architecture reported by
machineis covered by the errata entry. The two cited 7.8 entries cover all architectures. - If either entry cannot be matched confidently, mark the host as exposed and proceed with patch installation.
A recent timestamp on syspatch -l does not prove that these particular fixes are installed. Conversely, an older-looking patch list can still contain both corrections. Match the entries, not the apparent age of the system.
Step 3: Apply missing corrections
OpenBSD distributes the fixes through syspatch. If the audit shows that one or both corrections are absent, run the system patch utility as an administrator:
syspatchAllow it to retrieve and install the patches offered for the installed release and architecture. Contemporary reporting on these fixes states that they are available through syspatch for all architectures. Follow the utility’s prompts and any maintenance-window requirements used by your organization.
- Do not substitute an application update for a system patch; the vulnerable code is in the kernel.
- Do not stop after the first relevant correction if the second one is still absent.
- Keep the host’s release and architecture recorded so that a patching failure can be diagnosed against the correct errata.
Step 4: Reboot into the corrected kernel
After installation, reboot the machine during an approved maintenance window. A syspatch operation can place a corrected kernel on disk without changing the kernel that is already executing. Until the reboot completes, the running kernel must still be treated as vulnerable.
When the system returns, repeat the release, architecture, and patch checks:
uname -r
machine
syspatch -lConfirm that the release and architecture are unchanged as expected, that both errata corrections now appear in the installed patch state, and that the reboot actually occurred after installation. If any check fails, do not downgrade the exposure classification.
Use this decision rule for every host
| Release and architecture recorded | shmat(4) overflow fix | Reference-counting fix | Reboot after patching | Classification |
|---|---|---|---|---|
| Known and matched to errata | Present | Present | Completed | Documented chain remediated |
| Known and matched to errata | Missing | Present or missing | Any state | Exposed |
| Known and matched to errata | Present | Missing | Any state | Exposed |
| Known and matched to errata | Both present | Both present | Not completed | Exposed until reboot and verification |
| Release or patch mapping uncertain | Cannot confirm | Cannot confirm | Any state | Exposed pending confirmation |
The table is intentionally conservative. Presence of both fixes in the patch database is necessary, but the machine should not be declared remediated until it has booted the corrected kernel.
Why network exposure is the wrong test
The entry point is a local system call and the demonstrated chain requires an unprivileged process that can create shared-memory objects, fork processes, and perform the other local kernel interactions used by the exploit. Whether a web server, mail daemon, firewall, or other network service is running does not determine whether the kernel is exposed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Instead, ask whether a local unprivileged account, service sandbox, scheduled job, or compromised application can execute code on the host. If local code execution is possible and either correction is absent, keep the machine in the exposed category even when it has no externally reachable service.
Comparing patched and unpatched machines
For an estate-wide review, collect the same fields from every machine rather than comparing patch timestamps informally.
- OpenBSD release: the value returned by
uname -r. - Architecture: the value returned by
machine. - shmat(4) correction: whether the errata entry is represented in
syspatch -l. - Reference-counting correction: whether the separate use-after-free fix is represented.
- Reboot status: whether the host restarted after both patches were installed.
- Local-code exposure: whether unprivileged users or services can run code on the machine.
A host with both corrections installed and a completed reboot is in a different security state from one with only the first correction, even if both were patched on the same day. Keep those states separate in asset records and remediation reports.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common checking mistakes and their fixes
Checking only the OpenBSD version
A version string identifies the release but not the installed syspatch state. Two machines on the same release can differ because one has received the errata and rebooted while the other has not. Always pair uname -r with syspatch -l.
Installing one patch and stopping
The exploit chain spans the shared-memory counter and a separate kernel reference-counting flaw. Treat the two errata entries as separate acceptance criteria.
Best Value
Forgetting the reboot
A corrected kernel on disk does not change the kernel already running. Schedule and verify the reboot, then repeat the commands after startup.
Assuming a network firewall removes the risk
Filtering inbound traffic does not prevent a local process from invoking the affected kernel interfaces. Base the decision on local execution and patch state.
Assuming 7.9 is covered by 7.8’s entry
Errata are release-specific. Consult the errata for the release shown by uname -r and match both corrections there. If the mapping is unclear, leave the host classified as exposed until an administrator confirms it.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is known about exploitation
As of an October 16, 2026 report, no CVE had been assigned to this issue and there was no evidence that it had been used in attacks. That status does not remove the need to patch: the demonstrated chain reaches local root, and the documented remediation is available through the operating system’s system-patch mechanism.
The exploit description is a proof of capability, not a requirement that an attacker reproduce every implementation detail on every hardware configuration. Its allocator assumptions and race timing may affect reliability, but they do not make an unpatched kernel safe to leave exposed.
Quick Recap
Minimal audit checklist
- Run
uname -rand record the release. - Run
machineand record the architecture. - Run
syspatch -l. - Match the installed list to the release errata for the shmat(4) integer-overflow correction.
- Match it separately to the kernel reference-counting/use-after-free correction.
- If either is absent or uncertain, run
syspatchand install the applicable fixes. - Reboot into the patched kernel.
- Repeat all three commands and retain the post-reboot evidence.
- Record the host as remediated only when both corrections are present and the reboot is confirmed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
