Executive brief
A security vulnerability exists in the OpenBSD operating system's handling of System V semaphores, which are tools used by programs to coordinate shared resources. A local attacker with access to the system could exploit this flaw to gain full administrative (root) control over the machine. This could lead to a complete compromise of the system, including unauthorized access to all data and the ability to disrupt operations.
Technical details
A use-after-free vulnerability exists in sys/kern/sysv_sem.c within the OpenBSD kernel. The flaw is triggered during a context switch following a tsleep() call in the sys_semget() function. Because the kernel failed to properly track references to semaphore structures, a semaphore could be freed or modified while a process was sleeping, leading to a use-after-free condition when the process resumed. A local attacker can exploit this race condition to execute arbitrary code with kernel privileges, resulting in privilege escalation to root. The fix introduces reference counters for System V semaphores to ensure they are not deallocated while in use.
Affected products
- OpenBSD OpenBSD up to 7.9
Timeline
- 2026-06-24: disclosed: CVE published by MITRE
- 2026-06-25: advisory: NVD entry published