# Kernel access check skipped

Kernel paths opening or pinning objects with privileged access mode or dropped share/write flags

_Area: Memory corruption and native code. Seen in 6 disclosed reports; latest 2026-02-26. Updated 2026-10-23._

## How it works
A kernel component opens, pins, or writes a resource on a caller's behalf but supplies a privileged access mode or drops the permission flags that normally gate the operation. The object manager, memory manager, or file system trusts the kernel caller and performs no access check, so the caller reaches a resource its own token or share mode should forbid. The broken assumption: "the kernel asked, so the caller is authorized."

## Where it shows up
- `ObOpenObjectByPointer` (or similar) called with `AccessMode=KernelMode` on a handle returned to user mode; the same API reimplemented from user mode into kernel mode without re-deriving the access check [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-gphfh-deep-dive-html.md)
- Kernel file opens using only attribute/synchronize rights plus `IO_IGNORE_SHARE_ACCESS_CHECK`, then writing via paging I/O [E7](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md)
- `pin_user_pages`/`get_user_pages` callers deciding `FOLL_WRITE` from one permission flag while ignoring another (e.g. CPU-write) [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-39793.md)
- Privileged brokers that elevate integrity but keep the caller's token (user-mode analog) [E8](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)

## How to review
For every kernel path that returns a handle, maps, or writes on a caller's behalf, verify the access mode and flags match the caller's actual rights, not the kernel's. The invariant: the effective permission used for the operation must be the intersection of the caller's token rights and the object's granted access, and share/write flags must reflect the real intent. Audit hooks: grep for `ObOpenObjectByPointer` with `AccessMode`, `IO_IGNORE_SHARE_ACCESS_CHECK`, `FltWriteFileEx` with paging flags, and every `get_user_pages`/`pin_user_pages` caller's `FOLL_WRITE` decision. Check each duplicated caller of the same primitive independently [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-39793.md). For brokers, confirm callers are authenticated by identity, not merely by process context [E8](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md).

## Variants seen
- KernelMode access mode in handle open skips all checks [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-gphfh-deep-dive-html.md)
- Share-access-check bypass plus paging write to read-only image sections [E7](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md)
- One of several permission flags ignored when pinning pages [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-39793.md)
- Integrity elevated but token unchanged, enabling cross-process injection (user-mode broker analog) [E8](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)

## Why fixes fail
A patch that added a combined CPU_WR|GPU_WR check to one `get_user_pages` caller left a duplicated pin path still deciding `FOLL_WRITE` from GPU_WR alone [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-39793.md). Fixing one call site does not fix the primitive.

## Impact and severity
Full compromise of protected processes and writes into supposedly immutable mapped images [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-gphfh-deep-dive-html.md)[E7](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md); read-only pages made host-writable [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-39793.md). Severity is high because the bypass is silent; for the handle-open case it needs only same-integrity or UIAccess access [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-gphfh-deep-dive-html.md), and duplicated call sites and broker trust models widen it [E2](https://bugbountylibrary.com/r/p0%3ACVE-2021-39793.md)[E8](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-gphfh-deep-dive-html.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2021-39793.md
- E3: https://bugbountylibrary.com/r/h1%3A1048322.md
- E4: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-invisible-miners-unveiling-ghostengine.md
- E5: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-hacking-display-monitors-monitor-command-control-set.md
- E6: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md
- E7: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md
- E8: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md