Threat Intelligence Database

CVE-2026-15449 is a medium severity time-of-check to time-of-use (TOCTOU) race condition vulnerability in the illumos-gate operating system's data-link pseudo-driver (dld). It affects the handling of specific ioctls on /dev/dld, allowing an unprivileged local user, including those confined to a non-global zone owning a datalink, to cause kernel heap corruption and potentially panic the system. The flaw arises from a race condition during ioctl request processing that can lead to writing beyond allocated kernel memory.

A heap-based buffer overflow vulnerability exists in the illumos-gate SCTP inbound path due to improper validation of address parameters in INIT ACK chunks. This flaw allows a remote unauthenticated attacker to cause out-of-bounds memory access and kernel heap corruption, potentially leading to remote code execution. The vulnerability has been present since 2010 and affects illumos distributions prior to a specific commit. No official patch or remediation guidance is currently provided.