Medium 5.4Published Oct 9, 2026

CVE-2026-104113Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon

Updated under an hour ago (2026-10-19 07:30 UTC)

Does this affect you?

It affects OmniOS. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for OmniOS

Exploited in the last 30 days

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

CVSS: 5.4 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness (CWE): CWE-415
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: illumos
NVD analysis: Awaiting Analysis
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

OmniOS OmniOS omnios:omnios (from the name)	from r151020 before r151054; from r151058 before r151058w; fixed at r151058w; from r151056 before r151056aw; fixed at r151056aw; from r151054 before r151054bw; fixed at r151054bw	CNA record

References

https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-serversmailing-list
https://github.com/omniosorg/illumos-omnios/commit/670d853f335203ce8a66126cdbb25bfdba973036patch
https://github.com/TritonDataCenter/illumos-joyent/commit/TBDpatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.