illumos dld CVE-2026-15449

Exploitation requires a local account on an illumos-based system with sufficient privilege to open /dev/dld and issue DLDIOC_GETMACPROP or DLDIOC_SETMACPROP ioctls; this access is available to an unprivileged local user including one confined to a non-global zone provided that zone has been granted datalink ownership by the administrator (a common configuration in SmartOS and Triton multi-tenant deployments). A multi-threaded process is required to mount the race: one thread issues the ioctl while a sibling thread concurrently overwrites pr_valsize in the shared user-space ioctl buffer between the kernel's two copyin calls. The AT:P metric in the CVSS 4.0 vector reflects this required timing coincidence. Exploitation is strictly limited to local access (AV:L); remote unauthenticated exploitation is not possible. Systems where no non-global zones hold datalink ownership, or where all local users are fully trusted operators, face no practical exposure to this vulnerability.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H) and score of 5.8 accurately represent the real-world risk profile. AV:L confines exploitation to local access, which meaningfully limits blast radius compared to network-exploitable kernel bugs. AT:P reflects the race-condition timing requirement - the attacker must win the window between two kernel copyin calls, which is non-trivial but reliably achievable on multi-core hardware with repeated attempts. PR:L confirms that no elevated privileges are needed, which is especially significant in multi-tenant environments such as SmartOS or Triton Data Center where zone administrators are routinely granted datalink ownership as an operational necessity; the vulnerability undermines the zone isolation boundary in that deployment model. The confirmed impacts are kernel heap corruption (VI:H) and system panic (VA:H); the description also notes the corruption 'may be usable for further compromise,' implying potential privilege escalation, though this is assessed as possible rather than confirmed. EPSS data is not available in the provided intelligence. The CVE is not in CISA KEV, and no public POC has been identified, which reduces immediate real-world exploitation probability. For operators of SmartOS or OmniOS in multi-tenant or cloud environments, the practical risk is elevated above what the numeric score suggests because the attack requires only zone-level access rather than full host access.

A low-privileged user or zone administrator on a SmartOS compute node opens /dev/dld and prepares a DLDIOC_SETMACPROP ioctl buffer in shared user-space memory, then spawns a concurrent thread that continuously writes an inflated value to pr_valsize while the main thread submits the ioctl repeatedly. When the race is won - pr_valsize is enlarged after the kernel allocates the heap buffer but before the second ddi_copyin() reads the full structure - the kernel writes more data than the buffer can hold, corrupting adjacent heap objects. On modern multi-core illumos hosts, the race window is realistically achievable through rapid repeated attempts. No public POC has been identified at time of analysis.