Vulnerability · Published Oct 9, 2026 · Assigned by illumos

CVE-2026-104113Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon

Medium 5.4

In plain English

A medium-severity double free in OmniOS from OmniOS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 4.0)5.4Medium

Exploit odds (30 days)0.1%top 98.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

Affected products (as reported)

Vendor	Product	Versions
OmniOS	OmniOS	r151020 – before r151054r151058 – before r151058wr151056 – before r151056awr151054 – before r151054bw

Weakness: CWE-415 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

In plain English

Official description

Affected products (as reported)

References