CVE-2026-80115 PassMark Software CVE debrief

Who should care

System administrators and security teams responsible for PassMark PerformanceTest, BurnInTest, and OSForensics deployments should assess exposure and prioritize patching based on deployment context.

Why it matters

CVE-2026-80115 is a privilege escalation and denial-of-service vulnerability in DirectIo64.sys within PassMark PerformanceTest, BurnInTest, and OSForensics. Local attackers can exploit this vulnerability to read arbitrary Model-Specific Registers or write zero to any MSR, potentially causing an immediate unrecoverable kernel crash or exposing security-sensitive information. System administrators and security teams should assess exposure and prioritize patching based on deployment context. The scope of affected versions and systems requires further verification from official sources.

• Local attackers can escalate privileges and cause denial-of-service.
• Security-sensitive MSRs can be read, potentially exposing kernel data structures.
• An immediate unrecoverable kernel crash can occur if the system call handler MSR is zeroed out.
• Verification of affected versions, exploitation, and remediation requires review of official sources.

Technical summary

The vulnerability in DirectIo64.sys allows local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs with insufficient blocklist enforcement. This can lead to an immediate unrecoverable kernel crash or the reading of security-sensitive MSRs used to locate kernel data structures. Affected product context includes PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. The defensive impact involves escalated privileges and potential denial-of-service conditions.

Defensive priority

High

Recommended defensive actions

• Review and apply vendor-provided patches for PassMark PerformanceTest, BurnInTest, and OSForensics.
• Restrict access to vulnerable systems and prioritize patching based on deployment context.
• Monitor system calls and IOCTLs for suspicious activity.
• Verify system configurations and inventory checks for affected versions.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and systems requires further verification from official sources. Affected product deployments need confirmation in managed environments. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance. Defenders should verify system configurations and inventory checks for affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.