Read the docs
TI-2026-70051 Aliases CVE-2026-104115

Stack buffer overflow in illumos reparsed lets local users crash it

Priority LOW 23CWE-121Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

illumos-gate from commit 2f172c55 before commit 6a2df4aa is affected, as are OmniOS releases before r151054bw, r151056aw and r151058w on their respective branches. The get_fs_locations() function in the nfs-basic reparse plugin copies host and path components into a fixed 1024-byte stack buffer without checking their length (CWE-121). A local user can send an overlong request to the reparsed door, which is readable by all users and does not check credentials, to crash the reparse daemon.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte stack buffer without checking their length. The reparsed door at /var/run/reparsed_door is readable by all users and the door server does not check the caller's credentials, so an unprivileged local user can send an nfs-basic request with an overlong host or path component to overflow the buffer. On systems built with stack protection, which is the default, this causes reparsed to abort; repeated requests place the svc:/system/filesystem/reparse service into maintenance. The service is disabled by default. The flaw has existed since 2009 (illumos-gate commit 2f172c55), and affects any illumos distribution prior to illumos-gate commit 6a2df4aa.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00137 3rd percentileScored 2026-11-07
Fix Fixed OmniOS (OmniOS): r151058w, r151056aw, r151054bw

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OmniOSOmniOSany to before r151054; r151058 to before r151058w; r151056 to before r151056aw; r151054 to before r151054bwr151058w, r151056aw, r151054bwPatch availableCNA
  • OmniOS VendorOmniOS Affected any to before r151054; r151058 to before r151058w; r151056 to before r151056aw; r151054 to before r151054bw Fixed in r151058w, r151056aw, r151054bw Patch available CNA

Remediation

Update illumos-gate to commit 6a2df4aa or later. Update OmniOS to r151054bw, r151056aw or r151058w, matching its release branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA OmniOS (OmniOS) Fixed in r151058w, r151056aw, r151054bw

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OmniOS r151054, r151054bw and 2 more versions

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-70048 Unreleased file descriptors in illumos nscd exhaust kernel memoryPriority LOW 29
    • TI-2026-70046 Reachable assertion in illumos bhyve lets guest panic hostPriority LOW 29
    • TI-2026-70050 NULL pointer dereference in illumos nwamd lets local users crash itPriority LOW 23
    Show all 7 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-104115
  2. 2026-10-11 Priority changed: MEDIUM → LOW
  3. 2026-10-16 CISA SSVC decision points changed

References

Patch 1

Other 2

  • TI-2012-00210 The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix… CVSS 2.0HIGH 7.2
  • TI-2021-19340 An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90… CVSS 3.1MEDIUM 5.5
  • TI-2026-12978 SCTP needs to better-check INIT ACK chunk parameters CVSS 4.0CRITICAL 9.1
  • TI-2020-16788 An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by… CVSS 3.1CRITICAL 9.8
  • TI-2016-05624 Improper input validation in illumos osnet-incorporation CVSS 3.0HIGH 8.6
  • TI-2019-06998 An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other… CVSS 3.1HIGH 8.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences