Read the docs
TI-2026-12996 Aliases CVE-2026-15449GHSA-5jqp-7hrf-w792

TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption

Priority LOW 25CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_valsize between the two copyins, so the second copyin and the subsequent property handling write beyond the end of the undersized allocation and corrupt the kernel heap. An unprivileged local user, including one confined to a non-global zone that owns a datalink, can trigger this to panic the system. The resulting kernel heap corruption may be usable for further compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00116 1st percentileScored 2026-11-07
Fix Fixed OmniOS (OmniOS): r151058j, r151056aj, r151054bjSmartOS (Triton Data Center): 202060709

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OmniOSOmniOSany to before r151054; r151058 to before r151058j; r151056 to before r151056aj; r151054 to before r151054bjr151058j, r151056aj, r151054bjPatch availableCNA
Triton Data CenterSmartOSany to before 202060709202060709Patch availableCNA
  • OmniOS VendorOmniOS Affected any to before r151054; r151058 to before r151058j; r151056 to before r151056aj; r151054 to before r151054bj Fixed in r151058j, r151056aj, r151054bj Patch available CNA
  • SmartOS VendorTriton Data Center Affected any to before 202060709 Fixed in 202060709 Patch available CNA

Remediation

  • Fix · CNA OmniOS (OmniOS) Fixed in r151058j, r151056aj, r151054bj
  • Fix · CNA SmartOS (Triton Data Center) Fixed in 202060709

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OmniOS r151054, r151054bj and 2 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-12978 SCTP needs to better-check INIT ACK chunk parametersPriority MEDIUM 49
    Show all 2 records →
  • Release ·

    Triton Data Center SmartOS 202060709

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-12978 SCTP needs to better-check INIT ACK chunk parametersPriority MEDIUM 49
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15449
  2. 2026-10-03 Alias added: GHSA-5jqp-7hrf-w792

References

Patch 1

Other 2

  • TI-2012-00210 The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix… CVSS 2.0HIGH 7.2
  • TI-2021-19340 An issue was discovered in illumos before f859e71… CVSS 3.1MEDIUM 5.5
  • TI-2026-12978 SCTP needs to better-check INIT ACK chunk parameters CVSS 4.0CRITICAL 9.1
  • TI-2020-16788 An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by… CVSS 3.1CRITICAL 9.8
  • TI-2016-05624 Improper input validation in illumos osnet-incorporation CVSS 3.0HIGH 8.6
  • TI-2019-06998 An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other… CVSS 3.1HIGH 8.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences