Is there a patch available for EUVD-2026-45034?

Yes, a patch is available for EUVD-2026-45034. Update the affected software to the latest version immediately.

illumos dld EUVD-2026-45034

Q: What is the CVSS score of EUVD-2026-45034?

EUVD-2026-45034 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-15449 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-16 illumos

GHSA-5jqp-7hrf-w792

Information Disclosure Smartos Illumos Omnios Illumos Gate

5.8

CVSS 4.0 · Vendor: illumos

Severity by source

Vendor (illumos) PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Race condition requires winning a kernel TOCTOU timing window (AC:H); low-privilege local account suffices (PR:L); kernel heap corruption enables scope change beyond the user process boundary (S:C).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (illumos).

CVSS VectorVendor: illumos

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 20:22 vuln.today

Analysis Generated

Jul 16, 2026 - 20:22 vuln.today

CVE Published

Jul 16, 2026 - 19:27 cve.org

MEDIUM 5.8

DescriptionCVE.org

A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_valsize between the two copyins, so the second copyin and the subsequent property handling write beyond the end of the undersized allocation and corrupt the kernel heap. An unprivileged local user, including one confined to a non-global zone that owns a datalink, can trigger this to panic the system. The resulting kernel heap corruption may be usable for further compromise.

AnalysisAI

Kernel heap corruption in the illumos data-link pseudo-driver (dld) allows an unprivileged local user - including one confined to a non-global zone that owns a datalink - to panic the system or potentially escalate privileges. The flaw in drv_ioc_prop_common() exploits a classic double-copyin TOCTOU race on the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls: the kernel sizes its heap allocation from pr_valsize on the first copyin but re-reads the entire ioctl struct from the same user address a second time, allowing a concurrent thread to enlarge pr_valsize between the two reads and overflow the under-sized buffer. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the upstream fix is confirmed by an illumos-gate commit.

Technical ContextAI

The vulnerable function is drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c, which services DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld, the illumos kernel data-link management device. The dld_ioc_macprop_t structure contains a fixed header (including the pr_valsize field) followed by a variable-length pr_val payload. CWE-367 (TOCTOU Race Condition) is the root cause: the driver calls ddi_copyin() once for sizeof(dld_ioc_macprop_t) to read pr_valsize, computes dsize = sizeof(dld_ioc_macprop_t) + pr_valsize - 1, allocates a kernel heap buffer of that size, then calls ddi_copyin() a second time for the full dsize bytes from the same user-space address. Because user memory can be modified between any two kernel reads, a racing write to pr_valsize after the allocation but before the second copyin causes the kernel to copy more bytes than were allocated. The fix (commit 6959feb5b430411a4809b06c53dcdb42fb525eac) eliminates the race by assigning the already-trusted in-kernel header copy (*kprop = *prop) and performing the second copyin only over the pr_val payload at the correct offset, so pr_valsize is never re-read from user space. A new DLD_MACPROP_BUFSIZE macro also corrects a size calculation error related to flexible-array-member padding. Affected CPEs are cpe:2.3:a:illumos:illumos-gate:*:*:*:*:*:*:*:*, cpe:2.3:a:omnios:omnios:*:*:*:*:*:*:*:*, and cpe:2.3:a:triton_data_center:smartos:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is available as illumos-gate commit 6959feb5b430411a4809b06c53dcdb42fb525eac (https://github.com/illumos/illumos-gate/commit/6959feb5b430411a4809b06c53dcdb42fb525eac); this is an upstream source commit rather than a tagged release, so the exact patched release version is not independently confirmed for illumos-gate, OmniOS, or SmartOS - administrators should monitor https://illumos.org/issues/18020 and their respective vendor release channels for downstream packages incorporating this change. As a compensating control where patching is not immediately feasible, restricting which zones receive datalink ownership via dlmgmtd and zone brand configuration eliminates the attack path for those zones: a non-global zone without datalink ownership cannot reach the DLDIOC_GETMACPROP or DLDIOC_SETMACPROP ioctl paths. The trade-off is that legitimate networking functionality requiring MAC-layer property access will be unavailable in those zones. There is no network-facing workaround because the attack vector is strictly local; network-layer firewall rules provide no mitigation.