Programming · by Isha Menon · 2026-10-16

Big Fish: exploiting a 37-year-old kernel bug in OpenBSD

A research writeup on a bug that sat in the OpenBSD kernel for 37 years. Makes you wonder how many similar bugs hide in mature codebases. Did AI-assisted auditing help here, or is this still classic expert work?

79 sparks · 9 comments

Comments

Laura Gómez · 11 likes

Reading the exploit chain was a good Friday afternoon. Truly clever.

Daniel Kiptoo · 10 likes

Makes me less smug about my 'secure by default' OS choices.

Imogen Clarke · 0 likes

Welcome to the club, we have cookies and CVEs

Ayesha Khan · 6 likes

The real question: how long until fuzzers+LLMs find the next 10 of these?

Oliver Smith · 5 likes

Mature code isnt the same as audited code. People forget that.

Ayesha Khan · 3 likes

37 years. I wasn't even born. Wild.

Aarav Sharma · 2 likes

I was born, still wild

João Pereira · 0 likes

OpenBSD folks are going to patch this in 5 minutes and write a snarky commit message.

Chiara Romano · 0 likes

Memory-safe languages for kernels would've killed this class of bug. Rust advocates incoming.