Is CVE-2026-15449 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15449 being exploited in the wild.

How severe is CVE-2026-15449?

Informational severity, with a CVSS score of 5.8, published 16 July 2026.

Which products and versions are affected?

Illumos-Gate before commit 6959feb5b430411a4809b06c53dcdb42fb525eac; OmniOS before r151054bj, r151056aj, or r151058j.

Is there a fix for CVE-2026-15449?

A patch was published on 2026-07-08: Fix committed to illumos-gate repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15449 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-15449?

Check whether you run Illumos-Gate or OmniOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15449: illumos data-link pseudo-driver TOCTOU heap overflow in dld ioctls

CVE-2026-15449 · Severity: info · CVSS 5.8 · Published 2026-07-16

A security vulnerability exists in the illumos operating system's networking driver. A local user, even one with restricted access, can exploit a timing flaw to cause a system crash (kernel panic). In some scenarios, this could potentially be used to gain higher-level control over the system, impacting overall stability and security.

Technologies: OmniOS. Vendors: Illumos, OmniOS.

Quick answers

Is CVE-2026-15449 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15449 being exploited in the wild.
How severe is CVE-2026-15449?: Informational severity, with a CVSS score of 5.8, published 16 July 2026.
Which products and versions are affected?: Illumos-Gate before commit 6959feb5b430411a4809b06c53dcdb42fb525eac; OmniOS before r151054bj, r151056aj, or r151058j.
Is there a fix for CVE-2026-15449?: A patch was published on 2026-07-08: Fix committed to illumos-gate repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15449 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-15449?: Check whether you run Illumos-Gate or OmniOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A TOCTOU (Time-of-Check to Time-of-Use) vulnerability exists in the drv_ioc_prop_common() function within usr/src/uts/common/io/dld/dld_drv.c. The driver performs a 'double copyin' of ioctl data: it first copies the header to determine the buffer size (pr_valsize), allocates memory, and then copies the full request from the same user-space address. A concurrent thread can modify the size field between these two operations, leading to a heap-based buffer overflow when the second copyin occurs. This can be triggered by an unprivileged local user via DLDIOC_GETMACPROP or DLDIOC_SETMACPROP ioctls on /dev/dld, resulting in a system panic or potential privilege escalation. Patches have been released for illumos-gate, OmniOS, and SmartOS.

Affected products

illumos illumos-gate before commit 6959feb5b430411a4809b06c53dcdb42fb525eac
OmniOS OmniOS before r151054bj, r151056aj, or r151058j
Triton Data Center SmartOS before 20260709

Timeline

2026-07-08: patched: Fix committed to illumos-gate repository
2026-07-16: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.