CVE-2026-80116 Overview
CVE-2026-80116 is a local privilege escalation vulnerability in the DirectIo64.sys kernel driver bundled with PassMark PerformanceTest, BurnInTest, and OSForensics. The driver exposes I/O control codes (IOCTLs) that perform PCI configuration space read and write operations without validating the caller-supplied device selection, register offset, or value. A local user with a handle to the device can issue arbitrary PCI configuration writes, enabling Bus Master Direct Memory Access (DMA) on any PCI device, halting storage controller I/O, or remapping Base Address Registers (BARs) to redirect DMA to an attacker-chosen physical address. The flaw is tracked as an [improper operation on register CWE-782] issue.
Critical Impact
A local attacker can weaponize a signed benign driver to perform arbitrary physical-memory manipulation via DMA, bypassing kernel isolation and achieving full system compromise.
Affected Products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Discovery Timeline
- 2026-09-04 - CVE-2026-80116 published to the National Vulnerability Database
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-80116
Vulnerability Analysis
The DirectIo64.sys driver ships with three PassMark utilities and provides a user-mode interface for low-level hardware access. The driver registers IOCTLs that accept caller-controlled parameters selecting a PCI device (bus, device, function), a configuration space register offset, and a value. The dispatch routines pass these values directly to PCI configuration mechanisms without authorization checks, range validation, or device whitelisting.
Because the device object is reachable by any local user holding a handle, the driver effectively grants unprivileged callers the ability to reprogram arbitrary PCI devices. Enabling the Bus Master bit in a device's command register permits that device to issue DMA transactions. Rewriting BARs relocates a device's memory-mapped I/O window to an attacker-chosen physical address, allowing DMA reads or writes into kernel memory, hypervisor structures, or firmware regions.
Root Cause
The root cause is missing input validation on IOCTL parameters that reach PCI configuration read/write primitives. The driver treats the caller as trusted, exposing hardware programming interfaces that should be gated by kernel-only callers. This matches [CWE-782: Exposed IOCTL with Insufficient Access Control].
Attack Vector
Exploitation requires local access with the ability to open the driver's device object. The attacker opens \\.\DirectIo64 (or the equivalent symbolic link), then issues crafted IOCTLs to perform PCI configuration writes. Three documented primitives are available: setting Bus Master DMA on any PCI device, clearing storage controller command registers to induce denial of service, and remapping BARs to overlap sensitive physical memory. Successful DMA-based writes into kernel memory yield SYSTEM-level code execution and undermine Virtualization Based Security. Technical primitives are documented in the Dkom disclosure post and the VulnCheck advisory.
Detection Methods for CVE-2026-80116
Indicators of Compromise
- Presence of DirectIo64.sys loaded on systems where PassMark tools are not authorized or expected.
- Unexpected user-mode processes opening handles to the DirectIo64 device object outside of PerformanceTest, BurnInTest, or OSForensics executables.
- Kernel logs or bug checks referencing DMA faults, invalid BAR access, or storage controller resets shortly after the driver is loaded.
Detection Strategies
- Inventory endpoints for the vulnerable driver versions using file hash and version metadata for DirectIo64.sys.
- Alert on unsigned or non-PassMark parent processes issuing DeviceIoControl calls against the driver's device name.
- Correlate driver load events (Windows Event ID 6 in the System channel or Sysmon Event ID 6) with subsequent process privilege changes to SYSTEM.
Monitoring Recommendations
- Enable Microsoft's Vulnerable Driver Blocklist and confirm DirectIo64.sys hashes are covered once Microsoft publishes updated blocklist entries.
- Monitor for creation of the \\.\DirectIo64 symbolic link and any handle-open activity from non-installer processes.
- Track kernel driver installation events on production systems and flag driver installations that occur without change-management approval.
How to Mitigate CVE-2026-80116
Immediate Actions Required
- Upgrade PerformanceTest to 11.1 build 1012 or later, BurnInTest to 11.1 build 1000 or later, and OSForensics to 11.1 build 1016 or later.
- Remove DirectIo64.sys from systems where the PassMark utilities are no longer required.
- Restrict local logon and administrative access on hosts that must run affected versions until patches are deployed.
Patch Information
PassMark has issued fixed builds for each affected product. Refer to the PerformanceTest release history, the BurnInTest release history, and the OSForensics update notes for build details. Additional coordination information is available in the floppywiggler/directio64-disclosure repository.
Workarounds
- Add the vulnerable DirectIo64.sys hashes to the Windows Driver Blocklist via Windows Defender Application Control (WDAC) policy.
- Uninstall PassMark tools on endpoints where hardware testing is not an operational requirement.
- Enforce Hypervisor-Protected Code Integrity (HVCI) to increase the difficulty of loading unsigned or blocklisted drivers.
# Example WDAC deny rule for the vulnerable driver hash
New-CIPolicyRule -Level Hash -DriverFilePath "C:\Path\To\DirectIo64.sys" -Deny
Merge-CIPolicy -PolicyPaths .\BasePolicy.xml,.\DenyDirectIo64.xml -OutputFilePath .\MergedPolicy.xml
ConvertFrom-CIPolicy -XmlFilePath .\MergedPolicy.xml -BinaryFilePath .\MergedPolicy.bin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
