# CVE-2026-27908 — Windows TDI Translation Driver `tdx.sys` Unreferenced TL Endpoint/Connection in the Request Path → Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `tdx.sys` (TDI Translation Driver / TDX) |
| **CVE ID** | CVE-2026-27908 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free (race-triggered) |
| **Delivery** | Local — concurrent TDI requests vs endpoint teardown (race) |
| **KB / Fixed build** | KB5083769 — `tdx.sys` 10.0.26100.8246 (Win11 24H2 x64) |
| **Patch Date** | April 14, 2026 (2026-Apr) |
| **Pre-patch binary** | `tdx.sys` 10.0.26100.7920 — SHA256 `3ee62af83c33d6bfb99d2bf3a45b3c279f4882b98d72188de2b6bca7491c2d17` |
| **Post-patch binary** | `tdx.sys` 10.0.26100.8246 — SHA256 `cbc81b0ffd9acf938c0a439ac8aa59a95415b68092676bab300b1c6c359447bb` |
| **Feature flag** | `Feature_490931514` / `Feature_2411928891` — **CFR-gated** |
| **Exploitability** | Exploitation **More Likely**; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`tdx.sys` is the Windows TDI Translation Driver, which translates legacy TDI client
calls to the modern TCP/IP transport. It tracks transport-address, **TL endpoint**,
and **connection** objects. Request paths — `TdxIssueListenRequest`,
`TdxIssueQueryAddressRequest`, `TdxIssueIoControlRequest` — operate on these objects,
while teardown paths — `TdxDeactivateTransportAddress`,
`TdxShutdownEndpointConnection`, `TdxCleanupObjectHeader` — free them.

---

## Vulnerability Summary

Pre-patch, the request paths used the TL endpoint / connection object **without
holding a reference under the endpoint lock**. A concurrent teardown
(`TdxDeactivateTransportAddress` / `TdxShutdownEndpointConnection`) could therefore
free the object while an in-flight request was still using it — a race (CWE-362)
yielding a use-after-free of the TL endpoint/connection (CWE-416). Because `tdx`
runs in the kernel and the TDI request interface is reachable by a local user,
winning the race (`AC:H`) is a local elevation-of-privilege primitive to SYSTEM (per
the MSRC FAQ); Microsoft rates exploitation **More Likely**.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`); `AC:H` — must win the race between a TDI
  request and endpoint/transport-address teardown.
- Result: an in-flight request uses a freed TL endpoint/connection object.

---

## Vulnerability Details

### Root Cause

The request handlers dereferenced the shared TL endpoint/connection object without
taking a reference under the endpoint lock, so teardown could free it while a
request was mid-flight.

### The patch (confirmed — diff, .7920 → .8246)

Gated behind `Feature_490931514` (request paths) and `Feature_2411928891`
(deactivation), the request handlers now **take an explicit reference on the object
under the endpoint spinlock before use**, and teardown decrements under the same
lock:

```c
// TdxIssueQueryAddressRequest (10.0.26100.8246) — PATCHED (from our diff)
uVar7 = KeAcquireSpinLockRaiseToDpc(endpoint + 2);
...
TdxIncrementTlEndpointReference(endpoint, ...);
DbgTdxReferenceConnection(endpoint, "TdxIssueQueryAddressRequest", 0x2d7);  // reference held across use
KeReleaseSpinLock(endpoint + 2, uVar7);

// TdxIssueListenRequest — DbgTdxReferenceTransportAddress under KeAcquireSpinLockRaiseToDpc
// TdxDeactivateTransportAddress (Feature_2411928891) — TdxDecrementTlEndpointReference under the endpoint lock
```

With a reference taken under the endpoint spinlock before use and released/decremented
under the same lock on teardown, the TL endpoint/connection cannot be freed while a
request holds it, closing the race/UAF.

### Patch Completeness Assessment

**CFR-gated behind `Feature_490931514` / `Feature_2411928891`.** The
reference-under-lock discipline runs only when the flags are enabled; the original
unsynchronized paths still ship when disabled. Verify the flags are enabled to
confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Concurrent TDI listen/query/ioctl requests racing transport-address
deactivation / endpoint shutdown; UAF / pool-corruption bugchecks in
`tdx!TdxIssueQueryAddressRequest` / `TdxDeactivateTransportAddress` /
`TdxShutdownEndpointConnection` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_490931514` /
`Feature_2411928891` are enabled.

---

## References

- MSRC advisory — CVE-2026-27908 (Windows TDI Translation Driver Elevation of Privilege), released 2026-04-14, KB5083769.
- Full binary diff: `/data/patch_diffs/tdx_sys-cve-2026-27908-ghidriff.md`