CVE-2026-93689: WinFsp Kernel Driver DOS Vulnerability

CVE-2026-93689 Overview

CVE-2026-93689 is a null pointer dereference vulnerability [CWE-476] in WinFsp through version 2.2.26215. The flaw resides in the kernel driver's Fast I/O device control handler, which fails to validate the volume context before dereferencing it. An unprivileged local user can trigger the condition by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, causing a system-wide crash (bugcheck).

Critical Impact
A local, low-privileged user can crash the Windows kernel by sending crafted IOCTLs to the WinFsp control device, resulting in a denial of service.

Affected Products

WinFsp versions through 2.2.26215
WinFsp kernel driver Fast I/O device control path (src/sys/devctl.c)
Windows systems where WinFsp is installed and the control device is accessible to local users

Discovery Timeline

2026-09-18 - CVE-2026-93689 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93689

Vulnerability Analysis

WinFsp is a Windows kernel driver that enables user-mode file system implementations. The vulnerable code path is the Fast I/O device control routine FspFastIoDeviceControl in src/sys/devctl.c. When a caller issues an FSP_IOCTL_TRANSACT, the handler validates that the target device is of kind FspFsctlDeviceExtensionKind but does not verify that the associated FileObject->FsContext2 — the volume context pointer — is initialized.

Because FSP_IOCTL_TRANSACT handling downstream dereferences FsContext2 to reach the volume object, an attacker who opens the control device without first attaching a volume context can drive execution into a null dereference. The dereference occurs at kernel IRQL, which promotes the fault to a bugcheck rather than a recoverable exception.

Root Cause

The root cause is missing input validation on the FileObject state prior to use in the Fast I/O dispatch path. The kernel driver assumed all FSP_IOCTL_TRANSACT requests would arrive on file handles previously bound to a volume, but no gate enforced this invariant. See the WinFsp devctl.c source and the volume.c reference for the affected code.

Attack Vector

Exploitation requires local access with the ability to open the WinFsp control device. No elevated privileges are needed. The attacker calls CreateFile against the WinFsp control device, then issues a DeviceIoControl call with the FSP_IOCTL_TRANSACT control code without first performing the volume-binding transaction. The unvalidated FsContext2 is dereferenced in kernel mode, crashing the host.

// Patch from src/sys/devctl.c (FspFastIoDeviceControl)
    Result = DEBUGTEST(50) &&
        CanWait &&
        FSP_IOCTL_TRANSACT == IoControlCode &&
-        FspFsctlDeviceExtensionKind == FspDeviceExtension(DeviceObject)->Kind;
+        FspFsctlDeviceExtensionKind == FspDeviceExtension(DeviceObject)->Kind &&
+        0 != FileObject->FsContext2;
    if (!Result)
        FSP_RETURN();

Source: GitHub commit b8103265. The fix adds an explicit 0 != FileObject->FsContext2 check, forcing the Fast I/O path to fall through to the slower dispatch route when the volume context is not established.

Detection Methods for CVE-2026-93689

Indicators of Compromise

Unexpected Windows bugchecks (BSOD) referencing the winfsp.sys or winfsp-x64.sys driver in the faulting module field.
Minidump or full crash dumps showing a null pointer dereference in FspFastIoDeviceControl or downstream volume routines.
Repeated user-mode process crashes preceded by DeviceIoControl calls to the WinFsp control device from non-administrative processes.

Detection Strategies

Monitor the Windows System event log for BugCheck events (Event ID 1001) that identify winfsp.sys as the failing module.
Correlate process telemetry to identify local processes opening handles to \\.\WinFsp.Fsctl or \\.\WinFsp.Disk immediately prior to a crash.
Alert on unsigned or unusual binaries issuing DeviceIoControl calls against WinFsp devices from non-service accounts.

Monitoring Recommendations

Enable kernel crash dump collection and forward .dmp metadata to a centralized log store for triage.
Track WinFsp driver version across the fleet and flag hosts still running builds at or below 2.2.26215.
Baseline expected WinFsp callers (for example, backup or cloud-storage clients) and alert on new process names interacting with WinFsp devices.

How to Mitigate CVE-2026-93689

Immediate Actions Required

Upgrade WinFsp to release v2.2B4 or later, which contains the validation fix.
Inventory all endpoints and servers with WinFsp installed and prioritize multi-user hosts and terminal servers.
Restrict interactive and remote logon rights on systems where WinFsp cannot be upgraded immediately.

Patch Information

The issue is resolved by commit b8103265 in the WinFsp project. The patch adds a check for a non-null FileObject->FsContext2 inside FspFastIoDeviceControl before treating the request as a valid Fast I/O FSP_IOCTL_TRANSACT. Full advisory details are available in the VulnCheck advisory.

Workarounds

Uninstall WinFsp on systems that do not require user-mode file system functionality.
Limit local logon rights so that only trusted service accounts can reach the WinFsp control device.
Disable or stop the WinFsp launcher service on hosts pending patch deployment to reduce exposure.

bash

# Check installed WinFsp version on Windows (PowerShell)
Get-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\WinFsp' -ErrorAction SilentlyContinue |
    Select-Object -Property InstallDir, Version

# Stop the WinFsp launcher service as a temporary mitigation
Stop-Service -Name 'WinFsp.Launcher' -Force
Set-Service  -Name 'WinFsp.Launcher' -StartupType Disabled