CVE-2026-57589
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the OpenBSD kernel up to version 7.9, a use-after-free vulnerability exists in sys/kern/sysv_sem.c, allowing local privilege escalation to root. The issue occurs after a context switch following the tsleep call in sys_semget().
Risk Assessment
An attacker with local access can exploit this vulnerability to gain full root control over the system, compromising confidentiality, integrity, and availability.
Recommendation
Immediately upgrade OpenBSD to a version later than 7.9 that includes a fix for the use-after-free vulnerability in sysv_sem.c.
Other vulnerabilities in OpenBSD
See all- CVE-2017-1000372Critical
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.
- CVE-2026-56099Medium
A vulnerability in OpenBSD before commit 6a23123 (2026-06-18) in the mpls_do_error function within sys/netmpls/mpls_input.c allows remote attackers to read kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
- CVE-2026-55706Medium
In OpenBSD before commit 076e2b1, the sppp_pap_input function in sys/net/if_spppsubr.c allows authentication bypass via certain zero values for lengths.
- CVE-2023-40216Medium
OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
- CVE-1999-0481Medium
CVE-1999-0481 vulnerability concerns the 'poll' service in OpenBSD, which can lead to a denial of service.
- CVE-1999-0485Low
Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.
- CVE-1999-0062High
The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
Original NVD description (English source)
sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().