# clfs.sys Patch Diff — CVE-2026-44809

| | |
|---|---|
| Binary | clfs.sys (Windows Common Log File System Driver) |
| Pre-patch version | 10.0.28000.2179 |
| Post-patch version | 10.0.28000.2269 |
| KB | KB5094126 |
| CVE | CVE-2026-44809 — Use after free, Elevation of Privilege |
| Diff tool | ghidriff (Ghidra VersionTrackingDiff engine) |
| Functions changed | 3 (2 with code changes, 1 metadata-only) |
| Functions added | 2 |

## Summary

CVE-2026-44809 is a use-after-free fix in `CClfsLogFcbPhysical::FlushLog`'s
cleanup path. The patch adds a new staged-rollout (Controlled Feature
Rollout) flag, `Feature_3035089211`, and gates the actual fix behind it: in
both the normal-exit path (`FlushLog` itself) and the exception-handling
finally block (`fin$0`), the patched code now checks
`Feature_3035089211__private_IsEnabledDeviceUsageNoInline()` and, only when
the flag is enabled, nulls out a pointer at `this + 0x548` before it can be
dereferenced after the stack frame holding the pointed-to value goes out of
scope. That pointer is what the use-after-free centers on. Because the fix
is feature-flagged, it is currently inert in any build where Microsoft
hasn't yet flipped `Feature_3035089211` on for that cohort — the vulnerable
code path still exists in the binary either way.

## Functions changed

### `CClfsLogFcbPhysical::FlushLog'::__l1::fin$0

| | |
|---|---|
| Address | 14001ae90 -> 14001af50 |
| Change type | code, length, address, called |
| Similarity | 0.83 |
| Patch flag added | **Yes** — `Feature_3035089211__private_IsEnabledDeviceUsageNoInline` |

This is the compiler-generated `finally` block for `FlushLog`'s exception
handling. The patch adds a flag-gated check that clears the back-pointer at
`this + 0x548` before `ReleaseFlushRef` runs, preventing that pointer from
later being dereferenced once the stack frame (and the structure it points
into) goes out of scope.

```c
  if (*(char *)(param_2 + 0x32) != '\0') {
    uVar1 = Feature_3035089211__private_IsEnabledDeviceUsageNoInline();
    if ((((int)uVar1 != 0) && (*(char *)(param_2 + 0x31) != '\0')) &&
       (*(longlong *)(this + 0x548) == param_2 + 0x50)) {
      *(undefined8 *)(this + 0x548) = 0;
    }
    CClfsLogFcbPhysical::ReleaseFlushRef(this);
    *(undefined1 *)(param_2 + 0x32) = 0;
  }
```

### CClfsLogFcbPhysical::FlushLog

| | |
|---|---|
| Address | 14000ef80 |
| Change type | code, length, called |
| Similarity | 0.56 |
| Patch flag added | **Yes** — `Feature_3035089211__private_IsEnabledDeviceUsageNoInline` |

Mirrors the `fin$0` change on the normal (non-exception) code path. Before
decrementing the refcount and potentially calling `CompleteFlush`, the
patched code checks the same flag and, if enabled, nulls out `this + 0x548`
when it still references the local stack variable `local_58` — closing the
same dangling-pointer window from the other exit path.

```c
  if (bVar5) {
    uVar16 = Feature_3035089211__private_IsEnabledDeviceUsageNoInline();
    if ((((int)uVar16 != 0) && (bVar4)) && (*(undefined8 **)(this + 0x548) == &local_58)) {
      *(undefined8 *)(this + 0x548) = 0;
    }
    LOCK();
    pCVar1 = this + 0x51c;
    iVar12 = *(int *)pCVar1;
    *(int *)pCVar1 = *(int *)pCVar1 + -1;
    UNLOCK();
    if (iVar12 == 1) {
      CompleteFlush(this);
    }
    (**(code **)(*(longlong *)this + 0x48))(this);
  }
```

### wil_details_IsEnabledFallback

| | |
|---|---|
| Address | 140011d08 -> 140011d38 |
| Change type | refcount, address, calling |
| Similarity | 1.0 (body byte-identical) |
| Patch flag added | No |

This function's own instructions are unchanged pre/post patch. The only
diff is to its metadata `calling` list — a newly added function,
`Feature_3035089211__private_IsEnabledFallback`, now calls into it as part
of the standard WIL feature-flag evaluation/fallback plumbing. It is
flag-check infrastructure, not a flag-gated fix site itself.

```diff
--- wil_details_IsEnabledFallback calling
+++ wil_details_IsEnabledFallback calling
@@ -2,0 +3 @@
+Feature_3035089211__private_IsEnabledFallback
```

## Functions added

| Function | Address | Role |
|---|---|---|
| `Feature_3035089211__private_IsEnabledDeviceUsageNoInline` | 1400169e0 | Public entry point for evaluating the `Feature_3035089211` flag; falls back to `Feature_3035089211__private_IsEnabledFallback` on cache miss. |
| `Feature_3035089211__private_IsEnabledFallback` | 140016a1c | Thin wrapper that calls the shared `wil_details_IsEnabledFallback` with the feature descriptor for `Feature_3035089211`. |

---

<sub>Source: ghidriff diff of clfs-2026-05.sys (10.0.28000.2179, pre-patch) vs clfs-2026-06.sys (10.0.28000.2269, post-patch) — [download pre](/data/patch_diffs/binaries/clfs-2026-05.sys) / [download post](/data/patch_diffs/binaries/clfs-2026-06.sys). Patch-flag analysis generated by feeding each modified function's diff to an AI agent and asking it to identify added feature-flag/kill-switch checks. Raw ghidriff output (full metadata, decompiler options, mermaid charts) is preserved in diffing/2026-06/clfs-kb5094126/json/clfs_pre.sys-clfs_post.sys.ghidriff.json.</sub>