# CVE-2026-80093 — Cloud Files Mini Filter Driver `cldflt.sys` Abort-Path Sentinel Mis-Cast → Kernel UAF / Type Confusion (Local EoP to SYSTEM)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cldflt.sys` (Cloud Files Mini Filter Driver) |
| **CVE ID** | CVE-2026-80093 |
| **Impact** | Elevation of Privilege (local — to SYSTEM) via a race condition |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` (Talos: 8.8, `S:C`) |
| **CWE** | CWE-416: Use After Free (Talos classifies CWE-843: Type Confusion) |
| **Delivery** | Local — attacker runs a program that drives the Cloud Filter API |
| **KB / Fixed build** | KB5124008 — `cldflt.sys` 10.0.26100.9444 (Win11 24H2/25H2 x64) |
| **Patch Date** | September 8, 2026 (2026-Sep) |
| **Pre-patch binary** | `cldflt.sys` 10.0.26100.9278 — SHA256 `6084c66824fd2bc5fb0b1601affdd5e8119a5d76df181d0c12f97e2033ad8862` |
| **Post-patch binary** | `cldflt.sys` 10.0.26100.9444 — SHA256 `d108428a0541913751507f5f91da3f5837217f2cd65f6bebdcd52fcac6baf292` |
| **Feature flag** | `Feature_544180536` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation More Likely; not publicly disclosed; not exploited (per MSRC) |

> Public report: **Talos TALOS-2026-2445** names `CldStreamAbortOperation` /
> `CldiStreamPrepareRequestForNonCdqCompletion` and the `CfAbortOperation` trigger. The feature gate
> Talos shows inside `CldStreamAbortOperation` (Ghidra-mis-symbolized `Feature_H2E_WPA3SAE`) corresponds
> to `Feature_544180536` in this ghidriff. Microsoft calls it CWE-416 / CVSS 7.0 (`S:U`); Talos calls it
> CWE-843 / CVSS 8.8 (`S:C`) — the same sentinel mis-cast, described as UAF vs. type confusion.

---

## Product Description

`cldflt.sys` is the Cloud Files mini-filter (OneDrive Files On-Demand and other sync engines). Per stream
it keeps a list of in-flight requests at `OpenStream->RequestListHead`, protected by a callback-data-queue
(CDQ) lock, and services abort/cancel messages arriving on the `\CLDMSGPORT` communication port.

---

## Vulnerability Summary

`CldStreamAbortOperation` walks `OpenStream->RequestListHead` and, for each entry, recovers the request
with `CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry)` (i.e. `entry − 0x8`).
Pre-patch the CDQ lock is **released inside the loop**, opening a window in which a concurrent thread in
`CldiStreamProcessPendingHydrationRequests` inserts a **stack-based `LIST_ENTRY` sentinel** into the same
intrusive list. The abort walker treats that sentinel as an embedded request, fabricating a **fake
`CLD_STREAM_REQUEST_PARTIAL` backed by another thread's kernel stack**, then dereferences its fields and
writes through a fake `QueueContext` pointer — a use-after-free / type confusion yielding a kernel write
primitive (elevation to SYSTEM). Microsoft rates it **Important, 7.0**; Talos **8.8**.

---

## Prerequisites and Constraints

- Local code execution able to use the Cloud Filter API (`AV:L`, `PR:L`, `UI:N`).
- A race must be won (`AC:H`): a request is left pending (unanswered `OnFetchData`) while the attacker
  drives the abort walker, and a stack sentinel must be inserted during the unlocked window.

---

## Vulnerability Details

### Root Cause

The abort loop walked the request list while dropping the CDQ lock between iterations and assumed every
`LIST_ENTRY` was embedded in a real request at `−0x8`. A transient stack sentinel inserted by the
hydration path was therefore mis-cast into an attacker-influenceable fake request object.

### Trigger (from the Talos report)

Register a provider, create a dehydrated placeholder, read it to raise `OnFetchData`, and do **not**
respond (leaving a pending request). Then call the undocumented `CfAbortOperation(0, NULL, 0)` — wildcard
keys `ProviderKey=SyncRootKey=StreamKey=RequestKey=0` — so
`CldiPortProcessAbortHydration (0x4002) → CldSyncAbortOperation → CldStreamAbortOperation` repeatedly
walks every stream's request list, maximizing the race window.

### The patch (confirmed — diff, .9278 → .9444)

Gated behind `Feature_544180536`, `CldStreamAbortOperation` and its siblings
(`CldiStreamCompleteRequest`, `CldStreamClose`, `CldStreamHasPendingRequests`,
`CldiStreamPrepareRequestForNonCdqCompletion`) are restructured to complete/cancel requests under a
consistent lock: the loop now gates on `CldiStreamPrepareRequestForNonCdqCompletion` +
`CldiCanDoNonCdqCompletion` before `CldiStreamCompleteCanceledRequest`, rather than casting a raw,
possibly-sentinel list entry during an unlocked window.

```c
// CldStreamAbortOperation (.9444) — PATCHED shape (Feature_544180536)
CldiStreamCdqACQUIRE(&...->CallbackDataQueue, v10);
for (entry = head->Flink; entry != head; entry = *v16) {
    request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
    if (in_same_session && request->RequestorProcessId == ProcessId && key_matches) {
        if (Feature_544180536__IsEnabled()) {
            if (!CldiStreamPrepareRequestForNonCdqCompletion(request) ||
                !CldiCanDoNonCdqCompletion(request)) { CdqRELEASE; goto reacquire; }
            CldiStreamCdqRELEASE(...);
        }
        CldiStreamCompleteCanceledRequest(request, 0xC000CF16);
        goto reacquire;   // restart under a fresh lock rather than continue an unlocked walk
    }
}
```

### Patch Completeness Assessment

**CFR-gated behind `Feature_544180536`.** The locked completion runs only when the flag is enabled; the
original unlocked walk ships when disabled. Verify the flag is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Non-provider processes calling `CfAbortOperation` with all-zero keys against
`\CLDMSGPORT`; bug-checks / heap-corruption in `cldflt!CldStreamAbortOperation` or
`CldiStreamPrepareRequestForNonCdqCompletion` under load with pending hydration requests.

**Config.** The fix is CFR-gated — confirm `Feature_544180536` is enabled and that the Sep-2026 update
(24H2/25H2 `cldflt.sys` 10.0.26100.9444, KB5124008) is installed.

---

## References

- MSRC advisory — CVE-2026-80093 (Windows Cloud Files Mini Filter Driver Elevation of Privilege), 2026-09-08, KB5124008.
- Talos TALOS-2026-2445 — `CldiStreamPrepareRequestForMoreProcessing` type confusion (public technical report).
- Full binary diff: `/data/patch_diffs/cldflt_sys-cve-2026-80093-ghidriff.md`