# CVE-2026-21253 — Windows Mailslot File System `msfs.sys` Cancel-Routine Race in `MsAddDataQueueEntry` → Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `msfs.sys` (Mailslot File System driver) |
| **CVE ID** | CVE-2026-21253 |
| **Impact** | Elevation of Privilege |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free (cancel-routine race) |
| **Delivery** | Local race — `CancelIo` between IRP-enqueue and cancel-routine install |
| **KB / Fixed build** | KB5077181 — `msfs.sys` 10.0.26100.7840 (Win11 24H2 x64) |
| **Patch Date** | February 10, 2026 (2026-Feb) |
| **Pre-patch binary (no fix)** | `msfs.sys` 10.0.26100.4202 — SHA256 `c1be2b6c4e126baa3a060cadd925309e8665739c5bff4df88e13ff805466bb8e` |
| **Post-patch binary (fix present)** | `msfs.sys` 10.0.26100.7824 — SHA256 `c3212720c70241ce1d9aa9fbceba2820ebefa368bea6b36101a7b24768bb33d0` |
| **Feature flag** | `Feature_1829438777` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`msfs.sys` implements the Windows **Mailslot** file system. A blocking mailslot
read parks its IRP on the mailslot's **data queue** and installs a **cancel
routine** so the IRP can be cancelled. `MsAddDataQueueEntry` performs the enqueue
and cancel-routine setup.

---

## Vulnerability Summary

On the `a2 == 0` (blocking) path, pre-patch `MsAddDataQueueEntry` **linked the IRP
into the data-queue list first, then installed the cancel routine** with
`MsSetCancelRoutine` — a classic cancel-routine race:

- Between the enqueue and the `MsSetCancelRoutine` call, another thread's
  `CancelIo` can run. Because the cancel routine is still **NULL**, the I/O
  manager only sets the IRP's **Cancel flag** and does not invoke a routine.
- The pre-patch code **never re-checked the Cancel flag** after installing the
  routine, so the cancellation is silently lost. The IRP stays **permanently
  queued**.

When the mailslot's FCB/CCB objects are later freed, the still-queued IRP
references **freed memory** — a use-after-free (CWE-416).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`); `AC:H` reflects the race window.
- Race: issue a blocking mailslot read and `CancelIo` it in the narrow window
  between the IRP being queued and the cancel routine being set.
- Result: an orphaned queued IRP over freed FCB/CCB → UAF → EoP.

---

## Vulnerability Details

### Root Cause

The IRP was made cancellable-visible (enqueued) **before** the cancel routine was
installed, and the Cancel flag was not re-checked, so a cancellation that lands in
the gap is lost and the IRP is never removed/completed.

### The patch (confirmed — diff, .4202 → .7824; enabled in .7840)

Gated behind `Feature_1829438777`, `MsAddDataQueueEntry` adopts the standard
**set-then-recheck** cancel protocol: it atomically installs the cancel routine,
immediately checks the Cancel flag, and if the IRP was already cancelled, removes
it from the queue and completes it with `STATUS_CANCELLED`:

```c
// MsAddDataQueueEntry (patched) — from our diff
*(code **)(param_4 + 0x68) = MsCancelDataQueueIrp;          // install cancel routine (atomic exchange)
_InterlockedExchange64((__int64 *)(irp + 0x68), (__int64)MsCancelDataQueueIrp);
if (*(byte *)(irp + 0x44) /* Cancel flag */
    && _InterlockedExchange64((__int64 *)(irp + 0x68), 0)) {   // *** already cancelled? ***
    MsRemoveDataQueueIrp(param_4, param_1);                    // remove from queue
    *(int *)(irp + 0x30) = STATUS_CANCELLED;                  // complete with STATUS_CANCELLED
    ...
}
```

If the cancel arrives in the window, the recheck now catches it, the IRP is pulled
from the queue and completed, and no orphaned IRP is left to dangle over the freed
FCB/CCB. Our diff of `msfs.sys` 10.0.26100.4202 → .7824 confirms `MsAddDataQueueEntry`
gains the `Feature_1829438777`-gated cancel-routine install + Cancel-flag recheck +
`MsRemoveDataQueueIrp` completion; the February KB5077181 (.7840) ships it enabled.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1829438777`.** The set-then-recheck path runs only when
the flag is enabled; the original racy path still ships when disabled. Verify the
flag is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Blocking mailslot reads cancelled immediately (`CancelIo`) under
churn; UAF / pool bugchecks referencing a mailslot data-queue IRP after the
mailslot handle is closed.

**Crash signature.** UAF in `msfs!MsAddDataQueueEntry` / `MsCancelDataQueueIrp` /
`MsRemoveDataQueueIrp` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_1829438777` is enabled.

---

## References

- MSRC advisory — CVE-2026-21253 (Windows Mailslot File System Elevation of Privilege), released 2026-02-10, KB5077181.
- Full binary diff: `/data/patch_diffs/msfs_sys-cve-2026-21253-ghidriff.md`