CVE-2026-80093: a race condition leads to type confusion in Windows Cloud Files

A Cisco Talos researcher discovered CVE-2026-80093, a type confusion vulnerability in cldflt.sys, the Windows Cloud Files driver used by features such as OneDrive Files On-Demand.

The issue arises from a race between two threads operating on the pending request list, OpenStream->RequestListHead. CldiStreamProcessPendingHydrationRequests temporarily inserts a LIST_ENTRY sentinel located on the kernel stack into the list. At the same time, CldStreamAbortOperation traverses the same list, assuming that each entry belongs to a CLD_STREAM_REQUEST_PARTIAL structure. If the second thread processes the sentinel, a portion of the kernel stack is mistakenly interpreted as a CLD_STREAM_REQUEST_PARTIAL. Subsequent code accesses fields of this fake request, including a bogus QueueContext pointer, and performs a write through it.

In Talos's test, this results in a kernel crash. If an attacker can influence the fields of the fake request, the researchers note that this could potentially provide a write primitive.

To trigger the race, an attacker registers a Cloud Files provider, creates a dehydrated placeholder, and initiates a read from it. The provider does not respond to OnFetchData, leaving the request pending. Parallel calls to CfAbortOperation and CfDisconnectSyncRoot can then cause one thread to traverse the request list while another temporarily inserts the stack-based sentinel into it.

Microsoft released a patch for CVE-2026-80093 on September 8, 2026.

Article: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2445