Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Use-after-free / TOCTOU race (CWE-416/CWE-367) in the Windows Cloud Files mini filter driver cldflt.sys, local EoP. The hydration completion callback HsmiRecallPostProcessHydration and the handle-cleanup path HsmFltPreCLEANUP (via HsmpRecallTerminateProgressiveHydration) share the active-hydration-context pointer slot at StreamHandleContext+0x38. Completion inserts an entry only when the slot is empty via InterlockedCompareExchange64(slot, Entry, 0). PRE: the cleanup path used a destructive InterlockedExchange64(slot, 0) that unconditionally zeroed the slot, then began releasing the file handle. Immediately after the slot is zeroed, a completion callback on another CPU can CAS-insert a fresh hydration entry (slot==0 so the CAS succeeds) while cleanup has already begun freeing the handle -> the hydration path operates on a freed/invalid resource (UAF). Triggered by hydrating a cloud placeholder while concurrently closing the same handle. IN-HOUSE ghidriff of cldflt.sys 10.0.26100.8328 -> .8457 (May 12 2026, KB5089549) confirms the fix: gated behind CFR flag Feature_955245880, the cleanup path replaces InterlockedExchange64(slot,0) with a CAS-loop bit-marking protocol - InterlockedCompareExchange64(slot, old|1, old) sets bit 0 of the pointer (kernel pool >=8-byte aligned so ptr|1 is a non-zero sentinel), so the completion CAS(slot,Entry,0) can no longer succeed; the CAS loop's bit-0 test handles concurrent cleanups (skip via LABEL_77). The old 0x800 synchronization flag is now set only on the feature-disabled path. Note: our x64 24H2 diff shows Feature_955245880, differing from the circulated screenshots' Feature_1223681336 (build/arch difference); the ptr|1 marking mechanism is identical. We ship what our diff shows.

Cleanup zeroes the hydration slot, so a concurrent completion CAS re-inserts an entry against a handle being freed

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Anonymous