Executive brief
A security vulnerability exists in the illumos operating system's networking driver. A local user, even one with restricted access, can exploit a timing flaw to cause a system crash (kernel panic). In some scenarios, this could potentially be used to gain higher-level control over the system, impacting overall stability and security.
Technical details
A TOCTOU (Time-of-Check to Time-of-Use) vulnerability exists in the drv_ioc_prop_common() function within usr/src/uts/common/io/dld/dld_drv.c. The driver performs a 'double copyin' of ioctl data: it first copies the header to determine the buffer size (pr_valsize), allocates memory, and then copies the full request from the same user-space address. A concurrent thread can modify the size field between these two operations, leading to a heap-based buffer overflow when the second copyin occurs. This can be triggered by an unprivileged local user via DLDIOC_GETMACPROP or DLDIOC_SETMACPROP ioctls on /dev/dld, resulting in a system panic or potential privilege escalation. Patches have been released for illumos-gate, OmniOS, and SmartOS.
Affected products
- illumos illumos-gate before commit 6959feb5b430411a4809b06c53dcdb42fb525eac
- OmniOS OmniOS before r151054bj, r151056aj, or r151058j
- Triton Data Center SmartOS before 20260709
Timeline
- 2026-07-08: patched: Fix committed to illumos-gate repository
- 2026-07-16: disclosed: CVE published