EUVD-2026-39156
GHSA-w3gf-4959-2377
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user (AV:L/PR:L) exploiting a kernel-only race window (AC:H, unlike the input's AC:L) for root, yielding total C/I/A impact within unchanged scope.
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().
AnalysisAI
Local privilege escalation to root in OpenBSD through 7.9 arises from a use-after-free in the System V semaphore subsystem (sys/kern/sysv_sem.c). An authenticated local user calling sys_semget() can trigger a context-switch use-after-free after tsleep(), where a freed semid_ds_kern structure is reused, enabling kernel memory corruption and full root compromise. There is no public exploit identified at time of analysis, EPSS probability is low (0.12%), and the issue is not listed in CISA KEV; the upstream fix adds reference counting (sem_ref/sem_rele) around the sleep window.
Technical ContextAI
The affected component is the OpenBSD kernel's System V IPC semaphore implementation in sys/kern/sysv_sem.c, which manages struct semid_ds_kern objects allocated from sema_pool with a backing sem_base array. The root cause is CWE-416 (Use After Free): syscall paths such as sys_semget(), sys___semctl(), and sys_semop() drop the kernel lock and block in tsleep(), during which another thread can free the semaphore descriptor via semctl(IPC_RMID); on wakeup the original path continues to dereference the now-freed semaptr pointer. The vendor fix (sem.h rev 1.28, sysv_sem.c rev 1.69) introduces a struct refcnt sem_refcnt field and wraps the sleep windows with sem_ref()/sem_rele() so the object is only actually freed (semtot decremented, sem_base freed, pool_put) once the last reference is released, and replaces the stale seq/nsems revalidation checks with a simpler pointer-identity check (semaptr != sema[ix]).
RemediationAI
Apply the upstream OpenBSD source fix from commit 1957873d2063db11dab780eca75b5e629d1e838d (sysv_sem.c rev 1.69, sem.h rev 1.28), which adds refcounting around the tsleep windows; rebuild the kernel from patched -stable/-current source or apply the corresponding syspatch once released. This is an upstream fix available as a commit; a released patched version is not independently confirmed here, so track the OpenBSD errata/syspatch page for your release (7.9 and earlier). If you cannot rebuild immediately, the practical compensating control is to reduce untrusted local access to affected hosts, since exploitation requires local authenticated code execution - limiting the number of untrusted local accounts and restricting shell access materially lowers exposure, though it does not remove the flaw. Note there is no runtime toggle to disable the sysv_sem syscall path without a kernel rebuild, so patching is the only complete remediation. See https://nvd.nist.gov/vuln/detail/CVE-2026-57589 and https://vuldb.com/vuln/373593 for tracking.
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or e
Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today