Race-Condition

TL;DR MiniPlasma is a Windows local privilege escalation exploit that achieves standard user → SYSTEM on fully patched Windows 11 systems (including the May 2026 Patch Tuesday updates). The jaw-dropper? It targets the exact same vulnerability that Google Project Zero reported in September 2020 and Microsoft claimed to fix in December 2020. CVE: CVE-2020-17103 (CVSS 7.0) — supposedly patched Component: cldflt.sys — Windows Cloud Files Minifilter driver Flaw: TOCTOU race condition in HsmOsBlockPlaceholderAccess Impact: Full SYSTEM shell from standard user Affected: All Windows versions (confirmed on Win11 with May 2026 updates) Not affected: Latest Windows 11 Insider Preview Canary builds (suggests a fix may be incoming) Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/MiniPlasma The Ghost Patch Problem In cybersecurity, few things are more unsettling than a patch that never actually landed. That’s exactly what happened here. ...

Overview Attribute Value CVE ID CVE-2026-43121 Related CVE-2026-23263 (page array leak, same subsystem) CVSS Score ~7.8 (est., NVD enrichment pending) Vendor Linux Kernel Component io_uring/ZCRX (zero-copy receive) Vulnerability Type Missing bounds check → OOB heap write; Race condition → double-free Affected Linux kernel 6.12–6.19 (CONFIG_IO_URING_ZCRX=y) Patched ✅ Commit 770594e (bounds check) + 003049b1c4fb (atomic race fix), backported to v6.18.16 Exploit Status ⚠️ PoC demonstrated (kernel module + userspace harness) KEV Added Not yet What Is ZCRX? io_uring’s ZCRX (zero-copy receive) is a subsystem new to Linux 6.15 that lets userspace receive network packets directly into a registered memory region — no kernel copy needed. The NIC DMAs into the region, the kernel posts a completion event, and the user returns the slot when done via a refill queue. ...