# CVE-2026-80115: PassMark DirectIo64 privilege escalation and denial of service via insufficient IOCTL validation

Source: https://junglewise.ai/threats/cve-2026-80115-passmark-directio64-privilege-escalation-and-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80115 · Severity: medium · CVSS 6.1 · Published 2026-09-04

PassMark's DirectIo64.sys is a signed kernel driver used by PerformanceTest, BurnInTest, and OSForensics to provide privileged hardware access. The driver fails to properly validate or restrict access to IOCTLs that read and write Model-Specific Registers (MSRs), allowing unprivileged local users to crash the system or extract sensitive kernel data. An attacker can trigger an immediate kernel panic by zeroing the system call handler MSR, or read security-sensitive MSRs to locate kernel structures for further exploitation.

Technologies: [PassMark BurnInTest](https://junglewise.ai/threats/technologies/burnintest), [PassMark OSForensics](https://junglewise.ai/threats/technologies/osforensics), [PassMark PerformanceTest](https://junglewise.ai/threats/technologies/performancetest). Vendors: [PassMark](https://junglewise.ai/threats/vendors/passmark).

## Quick answers

**Is CVE-2026-80115 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80115 being exploited in the wild.

**How severe is CVE-2026-80115?** Medium severity, with a CVSS score of 6.1, published 4 September 2026.

**Which products and versions are affected?** PassMark BurnInTest before 11.1 build 1000; PassMark OSForensics before 11.1 build 1016; PassMark PerformanceTest before 11.1 build 1012.

**Is there a fix for CVE-2026-80115?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80115 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-80115?** Check whether you run PassMark BurnInTest, PassMark OSForensics or PassMark PerformanceTest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation and denial-of-service flaw in the DirectIo64.sys kernel driver, a signed hardware-access shim bundled with PassMark tools. The driver creates a device object with a permissive default DACL (0x1201bf grants FILE_GENERIC_READ|WRITE|EXECUTE to Everyone), and the IOCTL dispatcher has no per-request token, integrity level, or allowlist checks on MSR read/write operations. An unprivileged local attacker can open the device and directly invoke IOCTLs to read arbitrary MSRs (exposing kernel data structure locations) or write zero to any MSR. Writing zero to the system call handler MSR (IA32_LSTAR) immediately crashes the kernel on the next system call. The attack requires local code execution at medium integrity or above, but is otherwise unrestricted. Patches were released in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016 with an updated security descriptor (SDDL change) and increased blocklist enforcement.

## Affected products

- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016

## Timeline

- 2026-09-04: disclosed: CVE-2026-80115 published on NVD
- 2026-08-28: advisory: Technical disclosure and analysis published on dkom.dev
- 2025-04-15: other: Vulnerable DirectIo64.sys binary compiled and shipped in PerformanceTest 11.1 build 1008 and earlier

## References

- [https://dkom.dev/posts/directio64-disclosure/](https://dkom.dev/posts/directio64-disclosure/)
- [https://github.com/floppywiggler/directio64-disclosure](https://github.com/floppywiggler/directio64-disclosure)

## Related threats

- [PassMark DirectIo64.sys physical memory disclosure via IOCTL](https://junglewise.ai/threats/cve-2026-80119-passmark-directio64-sys-physical-memory-disclosure-via-ioctl)
- [PassMark PerformanceTest, BurnInTest, OSForensics physical memory disclosure in DirectIo64.sys](https://junglewise.ai/threats/cve-2026-80118-passmark-performancetest-burnintest-osforensics-physical-memory)
- [PassMark DirectIo64.sys privilege escalation via unvalidated I/O port access](https://junglewise.ai/threats/cve-2026-80117-passmark-directio64-sys-privilege-escalation-via-unvalidated-i-o)
- [PassMark DirectIo64.sys privilege escalation](https://junglewise.ai/threats/cve-2026-80116-passmark-directio64-sys-privilege-escalation)
- [PassMark DirectIo64.sys hardcoded credentials and privilege escalation](https://junglewise.ai/threats/cve-2026-80114-passmark-directio64-sys-hardcoded-credentials-and-privilege)