{"id":"CVE-2026-104113","revision":"6cbdf5b2046240b2a6cf93df5271f81e","records":[{"revision":"6cbdf5b2046240b2a6cf93df5271f81e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104113","aliases":[],"title":"Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon","description":"A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.","state":0,"publishedAt":"2026-10-09T14:17:00.527+00:00","modifiedAt":"2026-10-09T16:45:51.552+00:00","affected":[{"ecosystem":"Vendor product","name":"SUNWcs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"OmniOS\",\n                    \"product\": \"OmniOS\",\n                    \"platforms\": [\n                        \"x86\"\n                    ],\n                    \"packageName\": \"SUNWcs\",\n                    \"programFiles\": [\n                        \"usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"r151020\",\n                            \"lessThan\": \"r151054\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"r151058\",\n                            \"lessThan\": \"r151058w\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"r151058w\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"r151056\",\n                            \"lessThan\": \"r151056aw\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"r151056aw\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"r151054\",\n                            \"lessThan\": \"r151054bw\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"r151054bw\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"affected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","score":5.4,"severity":"MEDIUM"}],"references":["https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers","https://github.com/omniosorg/illumos-omnios/commit/670d853f335203ce8a66126cdbb25bfdba973036","https://github.com/TritonDataCenter/illumos-joyent/commit/TBD"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104113","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104113","identifiers":["CVE-2026-104113"]},"retained":false,"historicalAffected":[]}],"coverage":[]}