CVE-2026-15449

Name of the Vulnerable Software and Affected Versions illumos (affected versions not specified)

Description A time-of-check to time-of-use (TOCTOU) flaw exists in the data-link pseudo-driver (dld) regarding the handling of DLDIOC GETMACPROP and DLDIOC SETMACPROP ioctls on the /dev/dld endpoint. The function drv ioc prop common() reads the pr valsize field to allocate a kernel heap buffer and subsequently copies the full request from the same user address. A concurrent thread can modify pr valsize between these two operations, leading to a buffer overflow that corrupts the kernel heap. An unprivileged local user can exploit this to cause a system panic or potentially achieve further system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.