# CVE-2026-27926 — Windows Cloud Files Mini Filter `cldflt.sys` Unsynchronized Sync-Root Lifecycle → Race Condition / Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cldflt.sys` (Cloud Files Mini Filter Driver; on-demand files) |
| **CVE ID** | CVE-2026-27926 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-362: Race Condition → CWE-416: Use After Free |
| **Delivery** | Local — concurrent Cloud Files sync operations vs sync-root cleanup (race) |
| **KB / Fixed build** | KB5083769 — `cldflt.sys` 10.0.26100.8246 (Win11 24H2 x64) |
| **Patch Date** | April 14, 2026 (2026-Apr) |
| **Pre-patch binary** | `cldflt.sys` 10.0.26100.8115 — SHA256 `482f523f80574231c057762c9579666d9d5377633f4a907ced5cde37899dc257` |
| **Post-patch binary** | `cldflt.sys` 10.0.26100.8246 — SHA256 `d8592078fe8ea56197e1af8fa8427b55038f83f3bd42c92e6002c4dee96946b6` |
| **Feature flag** | `Feature_1074201912` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`cldflt.sys` is the Cloud Files Mini Filter (the kernel side of OneDrive / cloud
on-demand files). It tracks per-volume **sync root** objects in a Unicode prefix
table. `CldSyncGetRootInfo` / `HsmiCldGetSyncRootInfoByFileObject` look a sync root
up and read its info, while `CldSyncCleanup` / `CldiPortNotifyDisconnect` remove and
free it.

---

## Vulnerability Summary

Pre-patch, sync-root **lookup/info-read was not synchronized against cleanup**. A
concurrent `CldSyncCleanup` (or disconnect) could remove a sync root from the prefix
table and free it while another thread was still using it — a race (CWE-362) that
leaves a thread operating on a freed sync-root object, i.e. a use-after-free
(CWE-416). Because `cldflt` runs in the kernel and the sync operations are reachable
by a local user, winning the race (`AC:H`) is a local elevation-of-privilege
primitive to SYSTEM (per the MSRC FAQ).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`); `AC:H` — must win the race between a
  sync-root info read and its cleanup/disconnect.
- Result: a freed sync-root object is used.

---

## Vulnerability Details

### Root Cause

Sync-root lookups/reads and sync-root cleanup shared the prefix-table-backed object
with no locking or reference/rundown protection, so cleanup could free a root while
another path used it.

### The patch (confirmed — diff, .8115 → .8246)

Gated behind `Feature_1074201912`, the sync-root lifecycle is serialized:
`CldSyncCleanup` takes an **Flt push lock** around the prefix-table removal, and
`CldSyncGetRootInfo` takes **rundown protection and a reference** on the root before
using it:

```c
// CldSyncCleanup (10.0.26100.8246) — PATCHED (from our diff)
if (Feature_1074201912__private_IsEnabledDeviceUsageNoInline()) {
    FltAcquirePushLockExclusiveEx(&lock, 0);
    p = RtlNextUnicodePrefix(root + 0x78, 1);
    RtlRemoveUnicodePrefix(root + 0x78, p);          // removal under the lock
    ...
    FltReleasePushLockEx(&lock, 0);
}

// CldSyncGetRootInfo (10.0.26100.8246) — PATCHED (from our diff)
if (Feature_1074201912__private_IsEnabledDeviceUsageNoInline()) {
    status = CldiSyncReferenceRoot(root);            // take a reference
    ... use root ...
    ExReleaseRundownProtection(root + 0x58);         // rundown protection around use
}
```

With cleanup serialized by the push lock and the info path holding a
reference/rundown protection, the sync root cannot be freed while another thread is
using it, closing the race/UAF.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1074201912`.** The synchronization runs only when the
flag is enabled; the original unsynchronized path still ships when disabled. Verify
`Feature_1074201912` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Concurrent Cloud Files sync-root connect/query/cleanup on the same
root; UAF / pool-corruption bugchecks in `cldflt!CldSyncGetRootInfo` /
`CldSyncCleanup` / `HsmiCldGetSyncRootInfoByFileObject` on unpatched/flag-disabled
builds.

**Config.** The fix is CFR-gated — confirm `Feature_1074201912` is enabled.

---

## References

- MSRC advisory — CVE-2026-27926 (Windows Cloud Files Mini Filter Driver Elevation of Privilege), released 2026-04-14, KB5083769.
- Full binary diff: `/data/patch_diffs/cldflt_sys-cve-2026-27926-ghidriff.md`