Medium 6.8Published Oct 9, 2026

CVE-2026-104112Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory

Updated under an hour ago (2026-10-19 10:00 UTC)

Does this affect you?

It affects illumos-gate and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for illumos-gate

Exploited in the last 30 days

A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb5caa98), and affects any illumos distribution prior to illumos-gate commit af810a72.

CVSS: 6.8 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P
Weakness (CWE): CWE-772
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: illumos
NVD analysis: Awaiting Analysis
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

illumos illumos-gate illumos:gate (from the name)	from cb5caa98562cf06753163f558cbcfe30b8f4673a before af810a72c09944e884ec695e8dbf1702a4f424ae; fixed at af810a72c09944e884ec695e8dbf1702a4f424ae	CNA record
OmniOS OmniOS omnios:omnios (from the name)	from any before r151054; from r151058 before r151058w; fixed at r151058w; from r151056 before r151056aw; fixed at r151056aw; from r151054 before r151054bw; fixed at r151054bw	CNA record

References

https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-serversmailing-list
https://illumos.org/issues/18494issue-tracking
https://github.com/illumos/illumos-gate/commit/af810a72c09944e884ec695e8dbf1702a4f424aepatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.