A time‑of‑check to time‑of‑use (TOCTOU) flaw in the illumos data‑link pseudo‑driver (dld) allows an unprivileged local user to trigger a double copyin of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls. The first copyin reads the ioctl header to capture the property value size; a concurrent thread can enlarge that size before the second copyin, causing the kernel to allocate an undersized buffer and subsequently write beyond its end. The resulting heap corruption can crash the system and may be leveraged for further compromise. The weakness is classed as a heap‑based buffer overflow (CWE‑122) coupled with a TOCTOU race (CWE‑367).

The vulnerability affects the illumos family, including OmniOS, Triton Data Center SmartOS, and the illumos‑gate source tree. Specific affected versions are not enumerated in the advisory, so any current installation that has not applied the fix for issue 18020 is potentially vulnerable.

The CVSS score of 5.8 indicates medium severity, and the EPSS score of less than 1% reflects a low probability of active exploitation. It is not listed in CISA KEV, so no known public exploits are reported. The vulnerability requires local privilege and a race condition, risk level remains moderate due to the potential for system downtime and privilege escalation within the host.