CVE-2026-57589: Use-After-Free in OpenBSD semget() Leads to Local Privilege Escalation

Technical summary

CVE-2026-57589 is a use-after-free vulnerability in sys/kern/sysv_sem.c affecting OpenBSD through version 7.9. The vulnerability manifests in sys_semget() where a tsleep() call creates a window for a race condition. When a process is context-switched while asleep, the underlying memory structures can be freed and reallocated before the sleeping process resumes execution, leading to a double-free or access-after-free scenario. Exploitation results in arbitrary code execution with kernel privileges. The vulnerability is classified under CWE-416 (Use After Free).

Business impact

This vulnerability poses a critical risk to OpenBSD deployments, particularly multi-user systems or those running untrusted code. Any local user can escalate to root without authentication, enabling complete system compromise including data theft, malware installation, and lateral movement. Organizations relying on OpenBSD for security-critical infrastructure should treat this as an immediate threat requiring emergency patching.

Affected systems

OpenBSD versions up to and including 7.9 are affected. This includes all installations running 7.9 or earlier. Systems with local user accounts or services that can be exploited to gain code execution are at risk. Embedded OpenBSD deployments and systems with multiple tenant isolation requirements should be prioritized for remediation.

Exploitability

Exploitation requires local code execution but no prior privileges (PR:N), making it accessible to any user account on the system. The attack complexity is rated high (AC:H), suggesting reliable exploitation requires specific timing or system conditions to be met. However, the use-after-free class of vulnerabilities historically becomes more exploitable over time as attackers refine techniques. This is not remotely exploitable and does not require user interaction.

Remediation

Apply security updates from OpenBSD immediately upon availability. Organizations should monitor the OpenBSD security advisories page and errata information for patched versions. Until patches are available, restrict local access through process isolation, disable unnecessary services, and implement strict access controls on semaphore operations if possible through mandatory access control policies.

Patch guidance

Monitor OpenBSD's official security channels and the errata section of their website for release announcements. Patches will likely be delivered as part of errata updates or point releases. Verify the patch version against the official OpenBSD advisory before deployment. Test patches in a non-production environment first given the low-level kernel nature of the fix.

Detection guidance

Monitor system logs for unusual semget() calls or repeated failures in semaphore operations. Watch for suspicious context-switching patterns or processes attempting rapid semaphore creation and deletion. Endpoint detection and response (EDR) tools should monitor privilege escalation events, particularly those following semaphore-related syscalls. Kernel-level monitoring of use-after-free conditions may require custom kernel instrumentation or specialized tools.

Why prioritize this

This vulnerability merits immediate prioritization due to its combination of high CVSS score (7.4), complete integrity and confidentiality impact (I:H, C:H), and the ease of local privilege escalation on multi-user systems. The lack of authentication requirements and the direct path to root access make this a tier-one remediation target for any OpenBSD environment.

Risk score, explained

CVSS 3.1 score of 7.4 reflects high severity: local attack vector (AV:L), high attack complexity (AC:H), no privilege or user interaction required (PR:N, UI:N), unchanged scope (S:U), and complete impact across confidentiality, integrity, and availability (C:H, I:H, A:H). The high complexity rating acknowledges the timing-dependent nature of the race condition, but the impact potential justifies the HIGH severity classification.

Frequently asked questions