# CVE-2026-54999 — Windows TCP/IP `tcpip.sys` Wake-Port-Entry Teardown Race → Unauthenticated Adjacent-Network RCE

---

## Summary

| | |
|---|---|
| **Product** | Windows — `tcpip.sys` (TCP/IP stack) |
| **CVE ID** | CVE-2026-54999 |
| **Impact** | Remote Code Execution (unauthenticated, adjacent network) |
| **MSRC severity** | Critical |
| **CVSS** | 8.8 / 7.7 — `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| **Delivery** | Adjacent network — crafted traffic to the host (no authentication) |
| **KB / Fixed build (diffed lineage, 26H1)** | KB5101649 — `tcpip.sys` 10.0.28000.2525 (Win11 26H1 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `tcpip.sys` 10.0.28000.2113 (KB5089548) — SHA256 `7f2eb6cb3b183cc9597b4327720c373d8a1a64df94bf63c54d393e05b3a08dba` |
| **Post-patch binary** | `tcpip.sys` 10.0.28000.2525 (KB5101649) — SHA256 `5a5af3d66d34c66e3cd0c0a902e28becabbdba9286a913bb3bc62e79246b8f77` |
| **Feature flag** | `Feature_2930222395` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Lineage note: this diff is the **26H1 (build 28000)** pair `.2113 → .2525` (KB5101649);
> the same fix ships to the other affected lineages (24H2/26100, etc.). The July `tcpip.sys`
> update is very large (55 code changes / 171 modified functions); most of that is unrelated
> churn (e.g. a `Feature_TCPIP_Stack_Var_To_Heap_*` pool refactor around the
> `UdpConnectRedirect` context). The security-relevant change for this CVE is the
> **wake-port-entry teardown**, gated by `Feature_2930222395`.

---

## Product Description

`tcpip.sys` maintains a list of **wake port entries** (used by the network wake / low-power
port-registration path). `InetWakeAcquirePortAf` acquires/creates a port entry under a
spin lock; entries are removed and freed during teardown. The July update introduces a new
helper, `InetWakeRemovePortEntryIfPresent`.

---

## Vulnerability Summary

A wake-port-entry object is shared between the **acquire/use** path and the
**teardown/free** path. Pre-patch, the teardown performed its list-consistency check and
then **unlinked and freed the entry (`ExFreePoolWithTag`) outside the protecting lock**,
so two paths could operate on the same entry concurrently — freeing it while it was still
referenced, or freeing it twice (CWE-362). Because the wake port-registration path is
reachable via **attacker-supplied traffic on an adjacent network without authentication**
(`AV:A`, `PR:N`, `UI:N`), the freed-object reuse is a remote code-execution primitive
(Microsoft rates it **Critical, 8.8**).

> Confirmation level: the diff is a large `tcpip.sys` monthly rework; the isolable
> mechanism for this CVE is the wake-port-entry teardown change in `InetWakeAcquirePortAf`
> plus the new `InetWakeRemovePortEntryIfPresent`, gated by `Feature_2930222395`. Stated at
> confirmed-changed level.

---

## Prerequisites and Constraints

- Adjacent network, unauthenticated (`AV:A`, `AC:L`, `PR:N`, `UI:N`): send crafted traffic
  that drives the wake port-entry acquire/teardown paths.
- Race a port-entry teardown against its concurrent use.
- Result: the port entry is freed while still referenced / freed twice.

---

## Vulnerability Details

### Root Cause

The wake-port-entry unlink and free were performed outside the lock that protects the
entry, so teardown could race concurrent use — a use-after-free / double-free of the port
entry.

### The patch (confirmed — diff, .2113 → .2525)

Gated behind `Feature_2930222395`, the teardown is made race-safe by tracking an
**in-flight word at entry `+0x14` under the lock** and moving the removal into the new,
**idempotent** `InetWakeRemovePortEntryIfPresent`, so the final free happens exactly once:

```c
// InetWakeAcquirePortAf (10.0.28000.2525) — PATCHED (from the diff)
lock = KeAcquireSpinLockRaiseToDpc(&list_lock);
...
if (Feature_2930222395__private_IsEnabled()) {
    *(uint*)((char*)entry + 0x14) = 0;          // maintain the in-flight marker under the lock
    ...
    InetWakeRemovePortEntryIfPresent(entry);    // *** idempotent unlink (new in POST) ***
}
// free is now conditional on the in-flight state -> only one side performs the final release
```

`InetWakeRemovePortEntryIfPresent` is new in the patched build and has no pre-patch
counterpart; the unlink is changed from unconditional to idempotent, and the free is gated
on the in-flight word so a concurrent teardown cannot double-free or free-while-in-use,
closing the race.

### Patch Completeness Assessment

**CFR-gated behind `Feature_2930222395`.** The race-safe teardown runs only when the flag
is enabled; the original unsynchronized free still ships when disabled. Verify the flag is
enabled to confirm the fix is live. Given unauthenticated adjacent-network RCE, apply the
July 2026 update regardless.

---

## Detection Guidance

**Behavioural.** Use-after-free / pool-corruption bugchecks in `tcpip!InetWakeAcquirePortAf`
/ `InetWakeRemovePortEntryIfPresent` on unpatched/flag-disabled builds, correlated with
network-wake / port-registration traffic. Restrict adjacent-network exposure of affected
hosts.

**Config.** The fix is CFR-gated — confirm `Feature_2930222395` is enabled.

---

## References

- MSRC advisory — CVE-2026-54999 (Windows TCP/IP Remote Code Execution), released 2026-07-14, KB5101649.
- Full binary diff: `/data/patch_diffs/tcpip_sys-cve-2026-54999-ghidriff.md`