TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption

published 2026-07-16 3 mo ago modified 2026-07-17 3 mo ago also EUVD-2026-45034

cvss: 5.8; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits: 0; none known

A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_valsize between the two copyins, so the second copyin and the subsequent property handling write beyond the end of the undersized allocation and corrupt the kernel heap. An unprivileged local user, including one confined to a non-global zone that owns a datalink, can trigger this to panic the system. The resulting kernel heap corruption may be usable for further compromise.

Patch / fix

fixed in 2 links 1

OmniOS OmniOS r151054, r151054bj, r151056aj, r151058j
Triton Data Center SmartOS 20260709, 202060709

github.com/illumos/illumos-gate@6959feb commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-17)

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.8	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	5.8	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

illumos illumos-gate
OmniOS OmniOS
Triton Data Center SmartOS

Classification

Weakness

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-122 Heap-based Buffer Overflow

References

Sources

CVE List CVE-2026-15449
NVD CVE-2026-15449

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary