Quick answers
- Is CVE-2026-57589 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57589 being exploited in the wild.
- How severe is CVE-2026-57589?
- High severity, with a CVSS score of 7.4, published 25 June 2026.
- Which products and versions are affected?
- Openbsd up to 7.9.
- Is there a fix for CVE-2026-57589?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-57589 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-57589?
- Check whether you run Openbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free vulnerability exists in sys/kern/sysv_sem.c within the OpenBSD kernel. The flaw is triggered during a context switch following a tsleep() call in the sys_semget() function. Because the kernel failed to properly track references to semaphore structures, a semaphore could be freed or modified while a process was sleeping, leading to a use-after-free condition when the process resumed. A local attacker can exploit this race condition to execute arbitrary code with kernel privileges, resulting in privilege escalation to root. The fix introduces reference counters for System V semaphores to ensure they are not deallocated while in use.
Affected products
- OpenBSD OpenBSD up to 7.9
Timeline
- 2026-06-24: disclosed: CVE published by MITRE
- 2026-06-25: advisory: NVD entry published