Patch
CVE-2026-80093: a race condition leads to type confusion in Windows Cloud Files
Read on dbugs: https://dbu.gs/news/cve-2026-80093-a-race-condition-leads-to-type-confusion-in-windows-cloud-files-20260918
A Cisco Talos researcher discovered CVE-2026-80093 (https://dbu.gs/vulnerability/CVE-2026-80093), a type confusion vulnerability in "cldflt.sys", the Windows Cloud Files driver used by features such as OneDrive Files On-Demand.
The issue arises from a race between two threads operating on the pending request list, "OpenStream->RequestListHead". "CldiStreamProcessPendingHydrationRequests" temporarily inserts a "LIST_ENTRY" sentinel located on the kernel stack into the list. At the same time, "CldStreamAbortOperation" traverses the same list, assuming that each entry belongs to a "CLD_STREAM_REQUEST_PARTIAL" structure.
If the second thread processes the sentinel, a portion of the kernel stack is mistakenly interpreted as a "CLD_STREAM_REQUEST_PARTIAL". Subsequent code accesses fields of this fake request, including a bogus "QueueContext" pointer, and performs a write through it.
In Talos's test, this results in a kernel crash. If an attacker can influence the fields of the fake request, the researchers note that this could potentially provide a write primitive.
To trigger the race, an attacker registers a Cloud Files provider, creates a dehydrated placeholder, and initiates a read from it. The provider does not respond to "OnFetchData", leaving the request pending. Parallel calls to "CfAbortOperation" and "CfDisconnectSyncRoot" can then cause one thread to traverse the request list while another temporarily inserts the stack-based sentinel into it.
Microsoft released a patch for CVE-2026-80093 (https://dbu.gs/vulnerability/CVE-2026-80093) on September 8, 2026.
Article:
https://talosintelligence.com/vulnerability_reports/TALOS-2026-2445
CVE-2026-80093 — PT-2026-88050: https://dbu.gs/vulnerability/PT-2026-88050
Post summary
The text describes a race condition in the Windows Cloud Files driver (CVE-2026-80093) that can cause type confusion and kernel crash, and notes that Microsoft has released a patch for the vulnerability.
