CVE-2026-104114
Description
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.
How to fix
- illumos illumos-gate0f1064d97f1a43778ddf87d4e438b99872aed1a0 or later
- OmniOS OmniOSr151054, r151058w, r151056aw, r151054bw or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| illumos illumos-gate | 6ba597c56d749c61b4f783157f63196d7b2445f0 ≤ v < 0f1064d97f1a43778ddf87d4e438b99872aed1a0 | 0f1064d97f1a43778ddf87d4e438b99872aed1a0 |
| OmniOS OmniOS | any ≤ v < r151054, r151058 ≤ v < r151058w, r151056 ≤ v < r151056aw, r151054 ≤ v < r151054bw | r151054, r151058w, r151056aw, r151054bw |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.