# CVE-2026-69279 — Cloud Files Mini Filter Driver `cldflt.sys` Request Timeout Path Use-After-Free (Local EoP to SYSTEM)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cldflt.sys` (Cloud Files Mini Filter Driver) |
| **CVE ID** | CVE-2026-69279 |
| **Impact** | Elevation of Privilege (local — to SYSTEM) via a race condition |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free |
| **Delivery** | Local — attacker drives cloud-file stream requests to force a timeout race |
| **KB / Fixed build** | KB5124008 — `cldflt.sys` 10.0.26100.9444 (Win11 24H2/25H2 x64) |
| **Patch Date** | September 8, 2026 (2026-Sep) |
| **Pre-patch binary** | `cldflt.sys` 10.0.26100.9278 — SHA256 `6084c66824fd2bc5fb0b1601affdd5e8119a5d76df181d0c12f97e2033ad8862` |
| **Post-patch binary** | `cldflt.sys` 10.0.26100.9444 — SHA256 `d108428a0541913751507f5f91da3f5837217f2cd65f6bebdcd52fcac6baf292` |
| **Feature flag** | `Feature_3750208824` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

> **Attribution (deduced).** This is the **third and last** distinct fix cluster in the Aug→Sep `cldflt`
> diff. CVE-2026-80093 is the `CfAbortOperation` race in `CldStreamAbortOperation` (`Feature_544180536`,
> confirmed by Talos TALOS-2026-2445); CVE-2026-83991 is the `CfCreatePlaceholders` supersede access-check
> (`Feature_1245077819`, confirmed by public PoC). The remaining `Feature_3750208824`-gated
> timeout/countdown-timer UAF cluster — the last functions in the diff, ending at
> `CldiStreamIsRequestExpired` — is therefore **CVE-2026-69279**, the September advisory's second CWE-416
> use-after-free. No public technical report exists for it; the gate and fix cluster are cleanly isolable,
> but the exact freed allocation was not independently traced.

---

## Product Description

`cldflt.sys` arms a **per-stream countdown timer** (`CldiStreamStartCountdownTimer`) whose worker
(`CldiStreamTimeoutWorker`) expires pending stream requests, using a global pending-request list
(`CldiStreamInsertIntoGlobalRequestListNoLock` / `…RemoveFromGlobalRequestListNoLock`,
`CldiStreamIsRequestExpired`, `TlmWriteFltTimeout`). Normal completion/cancellation acts on the same
`CLD_STREAM_REQUEST` objects.

---

## Vulnerability Summary

Pre-patch, the **timeout-driven** completion path raced with normal request completion/cancellation over
the same request object **without a consistent CDQ-lock discipline**. A request could be freed on one path
and still be used — dereferenced and completed — on the timeout path: a use-after-free of a stream request
in kernel context, i.e. a SYSTEM-elevation primitive for an attacker who wins the race. Microsoft rates it
**Important, 7.0**, with **Exploitation Unlikely** (`AC:H`) — winning a race against the kernel timeout
worker is materially harder than the on-demand `CfAbortOperation` trigger of the sibling CVE-2026-80093.

---

## Prerequisites and Constraints

- Local code execution able to drive cloud-file stream requests (`AV:L`, `PR:L`, `UI:N`).
- A race must be won (`AC:H`): a pending request must time out at the same moment it is being completed or
  cancelled on another path.

---

## Vulnerability Details

### Root Cause

The countdown-timer/worker path and the normal completion path both operated on the same request via the
global request list, but did not share a single lock discipline — allowing the timer path to complete a
request that had already been freed.

### The patch (confirmed — diff, .9278 → .9444)

Gated behind `Feature_3750208824`, `CldiStreamStartCountdownTimer` is rewritten (length **486 → 981**,
ratio 0.24) to route timeout completion through the **same locked non-CDQ helpers** introduced for the
abort fix — `CldiStreamPrepareRequestForNonCdqCompletion`, `CldiCanDoNonCdqCompletion`,
`CldiStreamCdqRELEASE`, `CldiStreamCompleteCanceledRequest` — under CDQ acquire/release:

```c
// CldiStreamStartCountdownTimer (.9444) — PATCHED shape (Feature_3750208824)
if (ExAcquireRundownProtection(&DAT_0) == 0) return;
if (Feature_3750208824__IsEnabled()) {
    // NEW: expire/cancel timed-out requests through the locked completion helpers
    // CldiStreamPrepareRequestForNonCdqCompletion / CldiCanDoNonCdqCompletion /
    // CldiStreamCdqRELEASE / CldiStreamCompleteCanceledRequest — under CDQ acquire/release,
    // so the timer path cannot complete a request another path already freed.
} else {
    // legacy timeout completion (unlocked wrt the completion path) — the vulnerable path
}
```

The added calls (`CldiCanDoNonCdqCompletion`, `CldiStreamCdqRELEASE`, `CldiStreamCompleteCanceledRequest`,
`CldiStreamPrepareRequestForNonCdqCompletion`) show up as new callees of `CldiStreamStartCountdownTimer` in
the diff, giving both September UAF fixes a single consistent lock discipline over the shared request list.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3750208824`.** The locked timeout completion runs only when the flag is
enabled; the original path ships when disabled. Verify the flag is enabled to confirm the fix is live.
Because the freed allocation was not independently traced (no public report), this RCA asserts the fix
mechanism and gate — which are isolable in the diff — rather than a specific proof-of-free.

---

## Detection Guidance

**Behavioural.** Bug-checks / heap-corruption in `cldflt` timeout paths
(`CldiStreamStartCountdownTimer` / `CldiStreamTimeoutWorker` / `CldiStreamCompleteCanceledRequest`) under
load with many pending, timing-out cloud-file requests. There is no simple on-demand trigger — the signal
is race-induced instability rather than a single call pattern.

**Config.** The fix is CFR-gated — confirm `Feature_3750208824` is enabled and the Sep-2026 update
(`cldflt.sys` 10.0.26100.9444, KB5124008) is installed.

---

## References

- MSRC advisory — CVE-2026-69279 (Windows Cloud Files Mini Filter Driver Elevation of Privilege), 2026-09-08, KB5124008.
- Full binary diff: `/data/patch_diffs/cldflt_sys-cve-2026-69279-ghidriff.md`
- Related September `cldflt` fixes in the same diff: CVE-2026-80093 (Talos TALOS-2026-2445), CVE-2026-83991 (`github.com/karollooool/CVE-2026-83991-writeup-and-poc`).