Security Advisory: Local Root Escalation in OpenBSD (CVE-2026-57589)

🌐 Official Government Notice

This information is sourced from the National Vulnerability Database (NVD), an official entity of the United States Government.

Security Reminder: Always verify you are on a .gov domain. Secure connections are indicated by HTTPS and the lock icon $\text{(🔒)}$ . Only share sensitive data on these verified, secure platforms.

🔍 Vulnerability Overview

A critical security flaw has been identified in OpenBSD versions up to and including 7.9. The vulnerability is classified as a Use-After-Free (UAF), which could be exploited by a local attacker to gain full administrative privileges.

~~Status: Awaiting Enrichment~~ $\rightarrow$ Status: Processing

Technical Summary

The flaw resides within the kernel source at sys/kern/sysv_sem.c. Specifically, the issue occurs during a context switch following a tsleep call inside the sys_semget() function.

Key Details:

CWE-ID: CWE-416 (Use After Free)
Impact: Local Privilege Escalation (LPE) to root.
Affected Component: System V Semaphores.

Execution Flow

The following diagram illustrates the logic failure leading to the vulnerability:

📊 Risk Metrics & Scoring

The severity of this vulnerability is calculated using the Common Vulnerability Scoring System (CVSS). The current base score is represented as:

$\text{Severity Score} = 7.4 \text{ (High)}$

Metric	Value	Description
CVSS Version	3.1	Standardized scoring system
Attack Vector	Local (`AV:L`)	Requires local access to the system
Complexity	High (`AC:H`)	Difficult to execute reliably
Privileges	None (`PR:N`)	No prior privileges required
User Interaction	None (`UI:N`)	No user action needed
Scope	Unchanged (`S:U`)	Impact is limited to the kernel
Confidentiality	High (`C:H`)	Total data exposure
Integrity	High (`I:H`)	Total system modification
Availability	High (`A:H`)	Total system crash/denial

Full Vector String:

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

🛠️ Remediation & Tracking

Current Action Items:

Identify affected OpenBSD versions ( $\le 7.9$ ).
Review the official patch in the source tree.
Apply kernel updates to all production systems.

Reference Links:

Source Patch: https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d
Additional Context: https://openai.com/index/patch-the-planet/

📜 Change History & Audit Trail

The record for CVE-2026-57589 has undergone several modifications:

2026-06-24 (9:16 PM): Initial record received from MITRE.
- Added description regarding sys/kern/sysv_sem.c.
- Assigned CWE-416 and CVSS v3.1 vector.
2026-06-25 (9:16 AM): CISA-ADP added SSVC data.
- technicalImpact: total
- exploitation: none
- automatable: no
2026-06-26 (1:16 AM): Final modification by CISA-ADP to update timestamps.

For inquiries regarding this entry, please contact the NVD team via their official email channels.