EUVD-2026-39156
GHSA-w3gf-4959-2377
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user (AV:L/PR:L) exploiting a kernel-only race window (AC:H, unlike the input's AC:L) for root, yielding total C/I/A impact within unchanged scope.
Primary rating from Vendor (mitre).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().
AnalysisAI
Local privilege escalation to root in OpenBSD through 7.9 arises from a use-after-free in the System V semaphore subsystem (sys/kern/sysv_sem.c). An authenticated local user calling sys_semget() can trigger a context-switch use-after-free after tsleep(), where a freed semid_ds_kern structure is reused, enabling kernel memory corruption and full root compromise. There is no public exploit identified at time of analysis, EPSS probability is low (0.12%), and the issue is not listed in CISA KEV; the upstream fix adds reference counting (sem_ref/sem_rele) around the sleep window.
Technical ContextAI
The affected component is the OpenBSD kernel's System V IPC semaphore implementation in sys/kern/sysv_sem.c, which manages struct semid_ds_kern objects allocated from sema_pool with a backing sem_base array. The root cause is CWE-416 (Use After Free): syscall paths such as sys_semget(), sys___semctl(), and sys_semop() drop the kernel lock and block in tsleep(), during which another thread can free the semaphore descriptor via semctl(IPC_RMID); on wakeup the original path continues to dereference the now-freed semaptr pointer. The vendor fix (sem.h rev 1.28, sysv_sem.c rev 1.69) introduces a struct refcnt sem_refcnt field and wraps the sleep windows with sem_ref()/sem_rele() so the object is only actually freed (semtot decremented, sem_base freed, pool_put) once the last reference is released, and replaces the stale seq/nsems revalidation checks with a simpler pointer-identity check (semaptr != sema[ix]).
RemediationAI
Apply the upstream OpenBSD source fix from commit 1957873d2063db11dab780eca75b5e629d1e838d (sysv_sem.c rev 1.69, sem.h rev 1.28), which adds refcounting around the tsleep windows; rebuild the kernel from patched -stable/-current source or apply the corresponding syspatch once released. This is an upstream fix available as a commit; a released patched version is not independently confirmed here, so track the OpenBSD errata/syspatch page for your release (7.9 and earlier). If you cannot rebuild immediately, the practical compensating control is to reduce untrusted local access to affected hosts, since exploitation requires local authenticated code execution - limiting the number of untrusted local accounts and restricting shell access materially lowers exposure, though it does not remove the flaw. Note there is no runtime toggle to disable the sysv_sem syscall path without a kernel rebuild, so patching is the only complete remediation. See https://nvd.nist.gov/vuln/detail/CVE-2026-57589 and https://vuldb.com/vuln/373593 for tracking.
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N
NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for chec
libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiu
Authentication bypass in OpenBSD's sppp PAP handler (sppp_pap_input in sys/net/if_spppsubr.c) lets an adjacent attacker
Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code
Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with ke
OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to beco
xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH envir
In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today