CVE-2026-90508 Overview
CVE-2026-90508 is a missing authorization vulnerability [CWE-862] in Chengdu Qilu Technology Ludashi version 6.1026.4715.714. The flaw resides in the MessageNotifyCallback function within the ProtectFilter64.sys kernel driver, part of the Message Dispatch Handler component. A local attacker with high privileges can invoke the callback without the expected authorization checks. Public exploit code has been released, though the vendor has not responded to disclosure attempts.
Critical Impact
Local attackers can interact with a privileged kernel driver interface that lacks authorization enforcement, potentially affecting integrity and availability of the protected process filter.
Affected Products
- Chengdu Qilu Technology Ludashi 6.1026.4715.714
- Component: Message Dispatch Handler
- Driver: ProtectFilter64.sys
Discovery Timeline
- 2026-09-13 - CVE-2026-90508 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90508
Vulnerability Analysis
The vulnerability affects the MessageNotifyCallback function inside ProtectFilter64.sys, a kernel-mode driver shipped with Ludashi. The Message Dispatch Handler exposes a callback path that processes messages without verifying whether the caller is authorized to trigger it. A local attacker able to reach the driver interface can dispatch messages that the routine will process as if they originated from a trusted component.
Because the code path resides in a signed kernel driver, invocation without authorization checks broadens the attack surface exposed to user-mode callers. According to the disclosure, exploit code has been made public, which lowers the barrier for reproduction. The vendor did not respond to the coordinated disclosure attempt, so no official fix is available.
Root Cause
The root cause is a missing authorization check [CWE-862] in MessageNotifyCallback. The function processes incoming dispatch messages without validating the identity, integrity, or privilege of the sender. Kernel callbacks that accept messages from user mode must enforce caller verification before acting on the input, and this driver does not.
Attack Vector
Exploitation requires local access with high privileges on the affected host. The attacker interacts with the ProtectFilter64.sys driver interface and issues crafted messages that reach MessageNotifyCallback. No user interaction is required. Since no verified proof-of-concept is embedded in the NVD record, refer to the GitHub Gist Code Snippet and the VulDB CVE-2026-90508 Entry for technical details on the disclosed exploit path.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90508
Indicators of Compromise
- Presence of ProtectFilter64.sys at version corresponding to Ludashi 6.1026.4715.714 on the host.
- Unexpected user-mode processes opening handles to the Ludashi driver device object.
- Unusual message dispatch activity originating from non-Ludashi processes.
Detection Strategies
- Monitor kernel driver load events for ProtectFilter64.sys and correlate with process ancestry.
- Alert on I/O control (IOCTL) requests to Ludashi driver devices issued by processes outside the vendor's install path.
- Baseline expected callers of the Message Dispatch Handler and flag deviations.
Monitoring Recommendations
- Enable Windows kernel auditing for driver object access and DeviceIoControl operations targeting third-party filter drivers.
- Collect endpoint telemetry on privileged local process activity, focusing on accounts with administrator rights.
- Review EDR telemetry for handle opens against Ludashi driver device names followed by anomalous message traffic.
How to Mitigate CVE-2026-90508
Immediate Actions Required
- Inventory hosts running Ludashi 6.1026.4715.714 and identify systems that load ProtectFilter64.sys.
- Restrict local administrative access on systems where Ludashi is installed, since exploitation requires high privileges.
- Uninstall Ludashi from environments where it is not business-critical until a fix is published.
Patch Information
No vendor patch is available. According to the advisory, Chengdu Qilu Technology was contacted about the disclosure but did not respond. Track the VulDB Vulnerability Details #403096 page for future updates and monitor vendor channels for a corrected build of ProtectFilter64.sys.
Workarounds
- Remove or disable the Ludashi application on affected endpoints to unload ProtectFilter64.sys.
- Apply application allow-listing to prevent unauthorized local processes from interacting with the vulnerable driver device.
- Enforce least-privilege policies to limit which accounts can obtain the local high-privilege access required for exploitation.
# Configuration example: check for the vulnerable driver on Windows
sc query ProtectFilter64
dir C:\Windows\System32\drivers\ProtectFilter64.sys
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
