The kernel source file sys/kern/sysv_sem.c contains a use‑after‑free bug that is triggered during a context switch after a tsleep call in sys_semget(). The flaw allows a local user to free a memory region and subsequently reference it, enabling execution of arbitrary code with kernel privileges. The result is privilege escalation to the root user with full system control. This weakness is classified as CWE‑416.

All OpenBSD releases up to and including 7.9 are affected. The vulnerability resides in the sysv_sem.c component of the kernel, meaning any system built from OpenBSD 7.9 or earlier code is at risk. Versions 7.10 and later contain the patch that fixes the use‑after‑free.

The CVSS score of 7.4 indicates a high‑severity local privilege escalation. EPSS is not available, so the current exploitation probability remains unknown. The vulnerability is not listed in the CISA KEV catalog, but the high severity and local nature suggest that an attacker with local access could exploit it. The likely attack vector requires a local user account that can invoke the sys_semget() system call, such as running a custom program or a legitimate application that uses semaphore operations.