CVE-2026-80113 Overview
CVE-2026-80113 is a local privilege escalation vulnerability in the DirectIo64.sys kernel driver shipped with several PassMark products. The driver exposes an IOCTL handler that fails to validate a user-supplied 64-bit physical memory address. Local attackers can open a handle to the device and invoke the handler to clear arbitrary bits at any physical address using MmMapIoSpace. Targeting kernel code pages or page table entries lets an attacker escalate privileges or compromise the operating system. The flaw is tracked as an improper handling of a parameter with mixed contents [CWE-782].
Critical Impact
Any authenticated local user can modify kernel memory and escalate to SYSTEM by clearing bits in kernel code or paging structures.
Affected Products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Discovery Timeline
- 2026-09-04 - CVE-2026-80113 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-80113
Vulnerability Analysis
The DirectIo64.sys driver is bundled with PassMark PerformanceTest, BurnInTest, and OSForensics to provide direct hardware I/O access from user mode. The driver registers a device object with a permissive DACL, allowing non-privileged local users to obtain a handle. One of its IOCTL handlers accepts a 64-bit physical address and a bit index from the caller, then maps the requested physical page into kernel virtual address space with MmMapIoSpace and clears the specified bit. Because the driver does not validate that the physical address belongs to a range the caller should be permitted to modify, the primitive can be aimed at any physical memory the system exposes, including kernel image pages and page table entries.
Root Cause
The root cause is missing validation of the physical address parameter passed through the exposed IOCTL. The driver trusts caller-supplied input and performs the bit-clear operation directly on the mapped kernel memory. This design places sensitive kernel primitives behind a user-accessible interface with no privilege check or address filtering.
Attack Vector
Exploitation requires local access with the ability to open the driver's device object. An attacker locates the physical address of a target kernel structure using standard side channels or driver-assisted reads, then issues the vulnerable IOCTL with that address and a chosen bit index. Clearing a single bit in a page table entry can disable the read-only or supervisor bit on a code page, enabling subsequent kernel code patching and privilege escalation to SYSTEM. Full technical details are documented in the Dkom disclosure article and the VulnCheck advisory.
No verified proof-of-concept code is reproduced here. Refer to the disclosure repository for the researcher's technical write-up.
Detection Methods for CVE-2026-80113
Indicators of Compromise
- Presence of DirectIo64.sys on hosts that do not require PassMark diagnostic tooling.
- Non-administrative processes opening a handle to the DirectIo64 device object.
- Unexpected loads of DirectIo64.sys outside of PassMark application startup.
- Kernel integrity alerts indicating modification of code pages or page table entries.
Detection Strategies
- Inventory endpoints for the vulnerable driver file and compare against approved software baselines.
- Alert on DeviceIoControl calls to the DirectIo64 device from processes not signed by PassMark.
- Correlate driver load events with subsequent token manipulation or SYSTEM-level process creation.
Monitoring Recommendations
- Enable Microsoft Vulnerable Driver Blocklist and monitor block events on legacy PassMark installations.
- Collect Sysmon Event ID 6 (driver loaded) and Event ID 1 (process create) for correlation.
- Forward kernel Code Integrity events (Event ID 3033, 3077) to your SIEM for review.
How to Mitigate CVE-2026-80113
Immediate Actions Required
- Upgrade PerformanceTest to 11.1 build 1012, BurnInTest to 11.1 build 1000, and OSForensics to 11.1 build 1016 or later.
- Uninstall PassMark products from systems that no longer need them so the vulnerable driver is removed.
- Ensure the Microsoft Vulnerable Driver Blocklist is enabled on all Windows endpoints and servers.
- Restrict local logon rights on production systems to reduce the pool of potential attackers.
Patch Information
PassMark has released fixed builds tracked in the PerformanceTest history, BurnInTest history, and OSForensics release notes. Applying these updates replaces DirectIo64.sys with a version that validates the IOCTL parameters.
Workarounds
- Remove or rename DirectIo64.sys on hosts where PassMark tooling cannot be updated immediately.
- Deny non-administrative access to the driver's device object using application allowlisting policies.
- Block loading of the vulnerable driver hash via Windows Defender Application Control (WDAC).
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.