CVE-2026-80115 PassMark Software CVE debrief

Who should care

System administrators and security teams responsible for PassMark PerformanceTest, BurnInTest, and OSForensics installations should assess exposure and apply patches to prevent potential security breaches. They should also review compensating controls for exposed systems, monitor for suspicious activity, and implement additional security controls to prevent local privilege escalation.

Why it matters

CVE-2026-80115 is a medium-severity vulnerability in PassMark PerformanceTest, BurnInTest, and OSForensics that allows local attackers to escalate privileges and cause denial-of-service. Defenders should assess exposure, apply patches, and monitor for suspicious activity.

• Local privilege escalation and denial-of-service vulnerability.
• Potential for kernel crash on the next system call.
• Read access to security-sensitive MSRs used to locate kernel data structures.
• Verification of affected versions and remediation efforts is necessary.

Technical summary

The vulnerability exists in DirectIo64.sys due to insufficient blocklist enforcement, allowing local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs. This can lead to a kernel crash on the next system call or provide read access to security-sensitive MSRs used to locate kernel data structures. The unrestricted write IOCTL can zero out the system call handler MSR, causing an immediate unrecoverable kernel crash on the next system call. Defenders should assess exposure, apply patches, and monitor for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Review and apply vendor-provided patches for PerformanceTest, BurnInTest, and OSForensics.
• Restrict access to sensitive system resources and monitor for suspicious activity.
• Implement additional security controls to prevent local privilege escalation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected products. Additional information is available from source references. The vulnerability exists in DirectIo64.sys due to insufficient blocklist enforcement, allowing local attackers to read arbitrary Model-Specific Registers or write zero to any MSR through exposed IOCTLs. The CVE record was published on 2026-09-04T19:17:28.280Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. To verify affected  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.