Read the docs
TI-2026-70049 Aliases CVE-2026-104113

Double free in OmniOS ipmgmtd lets local users crash the daemon

Priority LOW 23CWE-415Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

OmniOS r151020 and later, and SmartOS, are affected prior to the fix. A double free (CWE-415) in the IP management daemon ipmgmtd frees a caller's credential twice when it authorizes a request that changes interface configuration. A local user without the solaris.network.interface.config authorization can send such a request to crash the daemon, and repeated requests put the ip-interface-management service into maintenance, which blocks IP interface configuration.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00116 1st percentileScored 2026-11-07
Fix Fixed OmniOS (OmniOS): r151058w, r151056aw, r151054bw

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OmniOSOmniOSr151020 to before r151054; r151058 to before r151058w; r151056 to before r151056aw; r151054 to before r151054bwr151058w, r151056aw, r151054bwPatch availableCNA
  • OmniOS VendorOmniOS Affected r151020 to before r151054; r151058 to before r151058w; r151056 to before r151056aw; r151054 to before r151054bw Fixed in r151058w, r151056aw, r151054bw Patch available CNA

Remediation

Upgrade OmniOS to r151058w, r151056aw or r151054bw, the fixed versions listed for its release branches. The sources list no fixed version for SmartOS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA OmniOS (OmniOS) Fixed in r151058w, r151056aw, r151054bw

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OmniOS r151054, r151054bw and 2 more versions

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-70048 Unreleased file descriptors in illumos nscd exhaust kernel memoryPriority LOW 29
    • TI-2026-70046 Reachable assertion in illumos bhyve lets guest panic hostPriority LOW 29
    • TI-2026-70051 Stack buffer overflow in illumos reparsed lets local users crash itPriority LOW 23
    Show all 7 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-104113

References

Patch 2

Other 1

  • TI-2026-12978 SCTP needs to better-check INIT ACK chunk parameters CVSS 4.0CRITICAL 9.1
  • TI-2026-70048 Unreleased file descriptors in illumos nscd exhaust kernel memory CVSS 4.0MEDIUM 6.8
  • TI-2026-70046 Reachable assertion in illumos bhyve lets guest panic host CVSS 4.0MEDIUM 6.8
  • TI-2026-12996 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption CVSS 4.0MEDIUM 5.8
  • TI-2026-70051 Stack buffer overflow in illumos reparsed lets local users crash it CVSS 4.0MEDIUM 5.4
  • TI-2026-70050 NULL pointer dereference in illumos nwamd lets local users crash it CVSS 4.0MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences