CVE-2026-104112

The illumos IP management daemon (ipmgmtd) lacks an authorization check, allowing a local user to change the persistent IPMP configuration. The IPMGMT_CMD_IPMP_UPDATE command does not require the solaris.network.interface.config authorization, and its handler writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged user can add or remove interfaces from existing IPMP groups in the stored configuration, potentially disrupting network connectivity when the configuration is next applied.

The illumos zones statistics daemon (zonestatd) lacks an authorization check, allowing a local user in any zone to disrupt zonestat in other zones and determine which zones are running. The zsd_server() procedure handles the ZSD_CMD_NEW_ZONE command without checking the caller's credentials, allowing an unprivileged user to send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, potentially causing new zonestat requests to fail. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone.

A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte stack buffer without checking their length. The reparsed door at /var/run/reparsed_door is readable by all users and the door server does not check the caller's credentials, so an unprivileged local user can send an nfs-basic request with an overlong host or path component to overflow the buffer. On systems built with stack protection, which is the default, this causes reparsed to abort; repeated requests place the svc:/system/filesystem/reparse service into maintenance. The service is disabled by default. The flaw has existed since 2009 (illumos-gate commit 2f172c55), and affects any illumos distribution prior to illumos-gate commit 6a2df4aa.

A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.

In the illumos SCTP inbound path, association lookup for INIT ACK chunks is performed without adequate validation of address parameters. A remote attacker can send a crafted SCTP INIT ACK packet, causing out-of-bounds access and kernel heap corruption, potentially leading to remote code execution.

A TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) affects handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. The drv_ioc_prop_common() function copies data from user space twice, and a malicious thread can change the size between copies, causing a kernel heap buffer overflow. An unprivileged local user can trigger a system panic or potentially further compromise.