Answer in brief
CVE-2026-15449 records a Medium severity (CVSS 5.8) vulnerability in TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption. The current sources do not mark it as known exploited. The current feed maps illumos/illumos-gate (generic), OmniOS/OmniOS (generic), Triton Data Center/SmartOS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps illumos/illumos-gate (generic), OmniOS/OmniOS (generic), Triton Data Center/SmartOS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| illumos/illumos-gategeneric | >=eae72b5b807baa9116e64502cbb278edf15f3146 <6959feb5b430411a4809b06c53dcdb42fb525eac | 6959feb5b430411a4809b06c53dcdb42fb525eac |
| OmniOS/OmniOSgeneric | >=any <r151054 || >=r151058 <r151058j || >=r151056 <r151056aj || >=r151054 <r151054bj | r151054, r151058j, r151056aj, r151054bj |
| Triton Data Center/SmartOSgeneric | >=any <202060709 | 202060709 |
Published upstream
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 17, 2026
A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_valsize between the two copyins, so the second copyin and the subsequent property handling write beyond the end of the undersized allocation and corrupt the kernel heap. An unprivileged local user, including one confined to a non-global zone that owns a datalink, can trigger this to panic the system. The resulting kernel heap corruption may be usable for further compromise.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-15449 records a Medium severity (CVSS 5.8) vulnerability in TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption. The current sources do not mark it as known exploited. The current feed maps illumos/illumos-gate (generic), OmniOS/OmniOS (generic), Triton Data Center/SmartOS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps illumos/illumos-gate (generic), OmniOS/OmniOS (generic), Triton Data Center/SmartOS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| illumos/illumos-gategeneric | >=eae72b5b807baa9116e64502cbb278edf15f3146 <6959feb5b430411a4809b06c53dcdb42fb525eac | 6959feb5b430411a4809b06c53dcdb42fb525eac |
| OmniOS/OmniOSgeneric | >=any <r151054 || >=r151058 <r151058j || >=r151056 <r151056aj || >=r151054 <r151054bj | r151054, r151058j, r151056aj, r151054bj |
| Triton Data Center/SmartOSgeneric | >=any <202060709 | 202060709 |
Published upstream
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 17, 2026
A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macprop_t ioctl header in once to read its pr_valsize field, sizes and allocates a kernel heap buffer from that value, and then copies the full request in a second time from the same unprivileged user address. A concurrent thread can enlarge pr_valsize between the two copyins, so the second copyin and the subsequent property handling write beyond the end of the undersized allocation and corrupt the kernel heap. An unprivileged local user, including one confined to a non-global zone that owns a datalink, can trigger this to panic the system. The resulting kernel heap corruption may be usable for further compromise.
Quoted source text, attributed separately from HOL analysis.