# CVE-2026-15449: illumos data-link pseudo-driver TOCTOU heap overflow in dld ioctls

Source: https://junglewise.ai/threats/cve-2026-15449-illumos-data-link-pseudo-driver-toctou-heap-overflow-in-dld  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-15449 · Severity: info · CVSS 5.8 · Published 2026-07-16

A security vulnerability exists in the illumos operating system's networking driver. A local user, even one with restricted access, can exploit a timing flaw to cause a system crash (kernel panic). In some scenarios, this could potentially be used to gain higher-level control over the system, impacting overall stability and security.

Technologies: [OmniOS](https://junglewise.ai/threats/technologies/omnios). Vendors: [Illumos](https://junglewise.ai/threats/vendors/illumos), [OmniOS](https://junglewise.ai/threats/vendors/omnios).

## Quick answers

**Is CVE-2026-15449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15449 being exploited in the wild.

**How severe is CVE-2026-15449?** Informational severity, with a CVSS score of 5.8, published 16 July 2026.

**Which products and versions are affected?** Illumos-Gate before commit 6959feb5b430411a4809b06c53dcdb42fb525eac; OmniOS before r151054bj, r151056aj, or r151058j.

**Is there a fix for CVE-2026-15449?** A patch was published on 2026-07-08: Fix committed to illumos-gate repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15449 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-15449?** Check whether you run Illumos-Gate or OmniOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A TOCTOU (Time-of-Check to Time-of-Use) vulnerability exists in the drv_ioc_prop_common() function within usr/src/uts/common/io/dld/dld_drv.c. The driver performs a 'double copyin' of ioctl data: it first copies the header to determine the buffer size (pr_valsize), allocates memory, and then copies the full request from the same user-space address. A concurrent thread can modify the size field between these two operations, leading to a heap-based buffer overflow when the second copyin occurs. This can be triggered by an unprivileged local user via DLDIOC_GETMACPROP or DLDIOC_SETMACPROP ioctls on /dev/dld, resulting in a system panic or potential privilege escalation. Patches have been released for illumos-gate, OmniOS, and SmartOS.

## Affected products

- illumos illumos-gate before commit 6959feb5b430411a4809b06c53dcdb42fb525eac
- OmniOS OmniOS before r151054bj, r151056aj, or r151058j
- Triton Data Center SmartOS before 20260709

## Timeline

- 2026-07-08: patched: Fix committed to illumos-gate repository
- 2026-07-16: disclosed: CVE published

## References

- [https://github.com/illumos/illumos-gate/commit/6959feb5b430411a4809b06c53dcdb42fb525eac](https://github.com/illumos/illumos-gate/commit/6959feb5b430411a4809b06c53dcdb42fb525eac)
- [https://illumos.org/issues/18020](https://illumos.org/issues/18020)
- [https://illumos.topicbox.com/groups/developer/T923147fae854a738-M03c29e1be33dac2a5e3d9535/18020-double-copyin-of-dldioc-consumers](https://illumos.topicbox.com/groups/developer/T923147fae854a738-M03c29e1be33dac2a5e3d9535/18020-double-copyin-of-dldioc-consumers)

## Related threats

- [OmniOS ipmgmtd double free in credential handling](https://junglewise.ai/threats/cve-2026-104113-a-double-free-in-the-ip-management-daemon-ipmgmtd-of-omnios-and)
- [illumos SCTP heap corruption in INIT ACK processing](https://junglewise.ai/threats/cve-2026-15422-illumos-sctp-heap-corruption-in-init-ack-processing)