CVE-2026-80115: PassMark DirectIo64.sys Privilege Escalation

CVE-2026-80115 is a privilege escalation flaw in PassMark DirectIo64.sys driver affecting PerformanceTest, BurnInTest, and OSForensics. Attackers can exploit exposed IOCTLs to crash systems or access sensitive data. This article covers technical details, affected versions, impact, and mitigation steps.

CVE-2026-80115 Overview

CVE-2026-80115 is a local privilege escalation and denial-of-service vulnerability in the DirectIo64.sys kernel driver bundled with PassMark PerformanceTest, BurnInTest, and OSForensics. The driver exposes IOCTLs that allow user-mode callers to read arbitrary Model-Specific Registers (MSRs) and write zero to any MSR, with insufficient blocklist enforcement. Local attackers can zero out the system call handler MSR to trigger an unrecoverable kernel crash on the next system call, or read security-sensitive MSRs used to locate kernel data structures. The flaw is classified under CWE-782 (Exposed IOCTL with Insufficient Access Control).

Critical Impact
A low-privileged local user can crash the Windows kernel on demand or leak kernel pointers useful for further privilege escalation.

Affected Products

PassMark PerformanceTest before 11.1 build 1012
PassMark BurnInTest before 11.1 build 1000
PassMark OSForensics before 11.1 build 1016

Discovery Timeline

2026-09-04 - CVE-2026-80115 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80115

Vulnerability Analysis

The DirectIo64.sys driver ships with multiple PassMark products and exposes IOCTL interfaces that permit direct hardware access from user mode. Two IOCTLs are affected: one reads an arbitrary MSR by index, and another writes zero to an arbitrary MSR. Both interfaces filter caller-supplied MSR indices against an incomplete blocklist. Security-relevant MSRs, including those that control system-call dispatch and kernel base address resolution, remain reachable from user space.

On x86-64 Windows, the IA32_LSTAR MSR holds the kernel entry point invoked by the syscall instruction. Writing zero to this register causes the next system call from any process to transfer control to address 0, producing an immediate bugcheck. The read primitive additionally allows disclosure of MSR values that can be used to locate kernel structures, weakening kernel address space layout randomization.

Root Cause

The root cause is insufficient input validation on the MSR index parameter passed to the read and write IOCTL handlers. The driver's blocklist does not enumerate all sensitive MSRs, and the write path unconditionally issues wrmsr with a zero value once the incomplete check passes. Kernel drivers that expose privileged CPU instructions must enforce strict allowlists rather than blocklists.

Attack Vector

Exploitation requires local access and low privileges sufficient to open a handle to the DirectIo64 device. No user interaction is required. The attacker opens the device, issues a DeviceIoControl call with the write IOCTL, supplies the IA32_LSTAR MSR index (0xC0000082), and waits for any process to invoke a system call. The system crashes with an unrecoverable exception. See the Dkom disclosure post and GitHub disclosure repository for technical details and proof-of-concept references.

Detection Methods for CVE-2026-80115

Indicators of Compromise

Presence of DirectIo64.sys loaded on hosts that do not require PassMark diagnostic tooling.
Unexpected process handles opened to the \\.\DirectIo64 device object by non-PassMark binaries.
Bugchecks referencing invalid instruction fetch at address 0x0 on the system-call path, correlated with a preceding DeviceIoControl from an unprivileged process.

Detection Strategies

Inventory endpoints for vulnerable driver versions using file-hash and version metadata from the VulnCheck advisory.
Enable Microsoft's Vulnerable Driver Blocklist and monitor for load attempts of pre-patch DirectIo64.sys builds.
Alert on user-mode processes opening handles to kernel driver device objects associated with hardware diagnostic tools.

Monitoring Recommendations

Forward Windows kernel bugcheck telemetry and driver load events to a central SIEM for correlation.
Track IoCreateFile and DeviceIoControl activity referencing DirectIo64 across the estate.
Review crash dump metadata for repeated system-call MSR corruption patterns following third-party driver installation.

How to Mitigate CVE-2026-80115

Immediate Actions Required

Upgrade PerformanceTest to build 11.1.1012 or later, BurnInTest to 11.1.1000 or later, and OSForensics to 11.1.1016 or later.
Uninstall PassMark diagnostic products from production systems where they are not operationally required.
Enable the Microsoft Vulnerable Driver Blocklist and Hypervisor-Protected Code Integrity (HVCI) on supported Windows hosts.

Patch Information

PassMark released fixed versions that harden IOCTL input validation in DirectIo64.sys. Refer to the PerformanceTest history, BurnInTest history, and OSForensics update announcement for release notes and download links.

Workarounds

Restrict access to the \\.\DirectIo64 device object via ACL hardening on hosts where uninstall is not feasible.
Block loading of unsigned or known-vulnerable versions of DirectIo64.sys through Windows Defender Application Control policies.
Limit interactive logon on systems running the affected diagnostic tools to trusted administrators only.

bash

# Enable Microsoft Vulnerable Driver Blocklist via Windows Security
# Settings > Privacy & Security > Windows Security > Device Security > Core isolation
# Toggle "Microsoft Vulnerable Driver Blocklist" to On

# Verify driver presence on a host
Get-ChildItem -Path C:\Windows\System32\drivers\DirectIo64.sys -ErrorAction SilentlyContinue |
  Select-Object Name, VersionInfo