CVE-2026-15449

MediumCVSS 5.8

Published: 16/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.08%

0th percentile - higher than 0% of all known CVEs

Summary

A TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) affects handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. The drv_ioc_prop_common() function copies data from user space twice, and a malicious thread can change the size between copies, causing a kernel heap buffer overflow. An unprivileged local user can trigger a system panic or potentially further compromise.

Risk Assessment

The risk includes local privilege escalation or system crash (panic) by an unprivileged user, even in a non-global zone owning a datalink. This can lead to kernel heap corruption and potential full system compromise.

Recommendation

Apply the security patch provided by the illumos distributor immediately. Until patched, restrict access to /dev/dld for unprivileged users and monitor the system for unusual events.

Other vulnerabilities in illumos

CVE-2026-15422Critical
In the illumos SCTP inbound path, association lookup for INIT ACK chunks is performed without adequate validation of address parameters. A remote attacker can send a crafted SCTP INIT ACK packet, causing out-of-bounds access and kernel heap corruption, potentially leading to remote code execution.

Original NVD description (English source)

A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_valsize between the two copyins, so the second copyin and the subsequent property handling write beyond the end of the undersized allocation and corrupt the kernel heap. An unprivileged local user, including one confined to a non-global zone that owns a datalink, can trigger this to panic the system. The resulting kernel heap corruption may be usable for further compromise.