CVE-2026-57589: OpenBSD Privilege Escalation Vulnerability

CVE-2026-57589 Overview

CVE-2026-57589 is a use-after-free vulnerability [CWE-416] in the OpenBSD kernel, specifically within sys/kern/sysv_sem.c. The flaw affects OpenBSD through version 7.9 and allows local privilege escalation to root. The issue is a context switch use-after-free that occurs after a call to tsleep inside sys_semget(), the system call responsible for allocating System V semaphore sets. A local attacker who triggers the race condition can corrupt kernel memory and gain root privileges on the affected host.

Critical Impact
Local attackers can exploit the use-after-free in sys_semget() to achieve kernel memory corruption and full root privilege escalation on OpenBSD systems through 7.9.

Affected Products

OpenBSD through 7.9
OpenBSD kernel component sys/kern/sysv_sem.c
OpenBSD kernel header sys/sys/sem.h

Discovery Timeline

2026-06-25 - CVE-2026-57589 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57589

Vulnerability Analysis

The vulnerability resides in the OpenBSD System V semaphore implementation in sys/kern/sysv_sem.c. The sys_semget() system call manages allocation and lookup of semaphore identifiers. During allocation, the code calls tsleep to wait on a resource. tsleep yields the CPU and triggers a context switch, allowing other threads to execute and potentially free or reallocate the semaphore structure that the original thread still references. When the sleeping thread resumes, it operates on a stale pointer, producing a classic use-after-free condition in kernel space. Attackers who win this race can reclaim the freed memory with attacker-controlled data and pivot to arbitrary kernel write primitives, ultimately escalating to root.

Root Cause

The root cause is the absence of reference counting on SysV semaphore objects across blocking operations. Before the patch, sys_semget() retained references to semaphore state across a tsleep call without any mechanism to prevent the underlying object from being freed by a concurrent thread. The fix introduces explicit reference counters for SysV semaphores so that objects survive blocking operations until all consumers release them.

Attack Vector

Exploitation requires local code execution on the target host. An unprivileged user invokes semget() and related semaphore system calls in parallel, deliberately racing the tsleep window in sys_semget() against operations that free the semaphore. High attack complexity reflects the precise timing required to win the race, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the kernel.

-/*	$OpenBSD: sysv_sem.c,v 1.68 2026/05/16 21:17:43 mvs Exp $	*/
+/*	$OpenBSD: sysv_sem.c,v 1.69 2026/05/22 23:10:05 mvs Exp $	*/
 /*	$NetBSD: sysv_sem.c,v 1.26 1996/02/09 19:00:25 christos Exp $	*/

Source: OpenBSD Commit 1957873d — Introduces reference counters for SysV semaphores to fix the context switch use-after-free.

-/*	$OpenBSD: sem.h,v 1.27 2026/05/16 21:17:43 mvs Exp $	*/
+/*	$OpenBSD: sem.h,v 1.28 2026/05/22 23:10:05 mvs Exp $	*/
 /*	$NetBSD: sem.h,v 1.8 1996/02/09 18:25:29 christos Exp $	*/

Source: OpenBSD Commit 1957873d — Header changes that add the reference counter field used by the patched semaphore code.

Detection Methods for CVE-2026-57589

Indicators of Compromise

Unexpected kernel panics or page faults referencing sysv_sem or sys_semget in /var/log/messages and dmesg output.
Unprivileged processes acquiring UID 0 without invoking su, doas, or other expected setuid binaries.
High-frequency semget(2) and semctl(2) syscall bursts from unprivileged users, consistent with race-window probing.

Detection Strategies

Audit OpenBSD kernel version with uname -r and flag any host at 7.9 or earlier as exposed.
Enable ktrace on suspicious processes to capture syscall patterns targeting SysV semaphores.
Correlate process credential changes with prior semaphore syscall activity in centralized logging to identify exploitation chains.

Monitoring Recommendations

Forward /var/log/messages, authlog, and audit telemetry from OpenBSD hosts to a central log platform for retention and search.
Alert on kernel crash signatures or repeated tsleep related faults that may indicate failed exploitation attempts.
Track new root shells spawned from non-administrative user sessions and review the parent process tree.

How to Mitigate CVE-2026-57589

Immediate Actions Required

Apply the upstream OpenBSD patch that introduces reference counters for SysV semaphores in sys/kern/sysv_sem.c and sys/sys/sem.h.
Rebuild and reboot into the patched kernel on all OpenBSD hosts running 7.9 or earlier.
Restrict shell access on affected systems to trusted administrators until patching completes.

Patch Information

The fix is delivered in OpenBSD commit 1957873d2063db11dab780eca75b5e629d1e838d, which bumps sysv_sem.c to revision 1.69 and sem.h to revision 1.28. The patch adds explicit reference counting to SysV semaphore objects so that concurrent threads cannot free the structure while another thread is blocked in tsleep. Refer to the OpenBSD source commit for the complete diff and rebuild from current source following the standard OpenBSD kernel build procedure.

Workarounds

Disable or restrict SysV semaphore usage where workloads do not require it by limiting access to multi-user shell environments.
Reduce the attack surface by removing local shell access for untrusted users and enforcing doas policies for privileged operations.
Where patching cannot be performed immediately, isolate affected hosts on segmented network zones and increase audit logging on semaphore-related syscalls.

bash

# Verify OpenBSD version and confirm patched kernel
uname -a
sysctl kern.version

# Rebuild kernel from patched source tree
cd /usr/src/sys/arch/$(machine)/compile/GENERIC.MP
make obj && make config && make clean && make
make install
reboot