# CVE-2026-27929 — Windows LUA File Virtualization `luafv.sys` Store-Directory TOCTOU in `LuafvQueryStoreDirectory`

---

## Summary

| | |
|---|---|
| **Product** | Windows — `luafv.sys` (LUA File Virtualization filter driver / LUAFV) |
| **CVE ID** | CVE-2026-27929 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition |
| **Delivery** | Local — swap the store directory between check and use (race) |
| **KB / Fixed build** | KB5083769 — `luafv.sys` 10.0.26100.8246 (Win11 24H2 x64) |
| **Patch Date** | April 14, 2026 (2026-Apr) |
| **Pre-patch binary** | `luafv.sys` 10.0.26100.7920 — SHA256 `25d774136cd40c401ca568332f36c4a65a33f72312959b3b221189bd0c555cc9` |
| **Post-patch binary** | `luafv.sys` 10.0.26100.8246 — SHA256 `274756a992f21a006882fbfd4e0730276bf639fedabd431ea8b82787cf187378` |
| **Feature flag** | `Feature_3287483706` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`luafv.sys` (LUAFV) virtualizes file access for legacy (non-elevated) applications
into a per-user virtualization store. `LuafvQueryStoreDirectory` resolves and opens
the store directory (via `LuafvOpenDirectory`) and uses it for subsequent store
operations.

---

## Vulnerability Summary

Pre-patch, the store-directory resolution had a **time-of-check/time-of-use** window:
the directory that was validated and the directory subsequently opened/used were not
bound to the same object, so a local user could swap the path/target between the
check and the use (`AC:H` race) to redirect the privileged store operation to an
attacker-chosen directory (CWE-367). Because LUAFV runs in the kernel and performs
the store operation with elevated context, winning the race is a local
elevation-of-privilege primitive to SYSTEM (per the MSRC FAQ).

> Confirmation level: `LuafvQueryStoreDirectory` is the sole changed function and is
> confirmed code-changed under `Feature_3287483706`; the exact check/use instruction
> pairing is not fully isolable in the restructure, so the mechanism is stated at
> confirmed-changed level per the CWE-367 classification.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`); `AC:H` — must win the race to swap the
  store directory between check and use.
- Result: the privileged store-directory operation acts on the attacker-substituted
  target.

---

## Vulnerability Details

### Root Cause

The store directory was resolved/validated and then re-opened, without binding the
validated object to the one used, leaving a TOCTOU window an attacker could exploit
by substituting the target.

### The patch (confirmed — diff, .7920 → .8246)

Gated behind `Feature_3287483706`, `LuafvQueryStoreDirectory` is restructured so the
store-directory object is **captured once** (cached in the context at `param_3 + 0x20`
/ `+ 0x60`) and the `LuafvOpenDirectory` calls reissue consistently against that
captured object, so the checked directory and the used directory are the same:

```c
// LuafvQueryStoreDirectory (10.0.26100.8246) — PATCHED, feature-enabled branch (from our diff)
if (Feature_3287483706__private_IsEnabledDeviceUsageNoInline()) {
    dir = *(longlong *)(param_3 + 0x20);          // capture the directory object once
    *(uint **)(param_3 + 0x60) = ...;             // cache it in the context
}
status = LuafvOpenDirectory(param_1, param_3, *(longlong **)(param_3 + 0x60), ...);  // reuse captured object
```

By capturing and reusing the same directory object across check and use, the swap
window is removed, closing the TOCTOU.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3287483706`.** The hardened resolution runs only when the
flag is enabled; the original path still ships when disabled. Verify
`Feature_3287483706` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Rapid manipulation (rename/junction swap) of the LUAFV virtualization
store directory during virtualized file operations; anomalies/crashes in
`luafv!LuafvQueryStoreDirectory` / `LuafvOpenDirectory` on unpatched/flag-disabled
builds.

**Config.** The fix is CFR-gated — confirm `Feature_3287483706` is enabled.

---

## References

- MSRC advisory — CVE-2026-27929 (Windows LUAFV Elevation of Privilege), released 2026-04-14, KB5083769.
- Full binary diff: `/data/patch_diffs/luafv_sys-cve-2026-27929-ghidriff.md`