- Engineer — Plan: A public PoC exists and a patch has shipped, so if you run OpenBSD 7.9 on any host, upgrade immediately. No KEV listing and LPE-only scope (requires local access first) keeps this out of Act for most shops, but the PoC lowers the bar for post-compromise escalation.
- SOC/IR — Learn: No active exploitation campaign or IOCs are reported; the main value is understanding how KARL, SMAP, and SMEP mitigations can be chained past — useful context for evaluating kernel-hardening assumptions on any OS, but no hunt or detection action warranted today.
- Leader — Skip