Medium 5.4Published Oct 9, 2026

CVE-2026-104114NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon

Updated under an hour ago (Oct 28, 2026, 2:30 PM ET)

Does this affect you?

It affects illumos-gate and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for illumos-gate

Exploited in the last 30 days

A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.

CVSS: 5.4 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: illumos
NVD analysis: Awaiting Analysis
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

illumos illumos-gate illumos:gate (from the name)	6ba597c56d749c61b4f783157f63196d7b2445f0 builds before 0f1064d97f1a43778ddf87d4e438b99872aed1a0	CNA record
OmniOS OmniOS omnios:omnios (from the name)	from any before r151054; from r151058 before r151058w; fixed at r151058w; from r151056 before r151056aw; fixed at r151056aw; from r151054 before r151054bw; fixed at r151054bw	CNA record

References

References

https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers	mailing-list
https://illumos.org/issues/18495	issue-tracking
https://github.com/illumos/illumos-gate/commit/0f1064d97f1a43778ddf87d4e438b99872aed1a0	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.