CVE-2026-104113: Omnios

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

Affected products

• Omnios Omnios: from r151020, before r151054 (fixed in r151054); from r151058, before r151058w (fixed in r151058w); from r151056, before r151056aw (fixed in r151056aw); from r151054, before r151054bw (fixed in r151054bw)

Published 2026-10-09. Last modified 2026-10-09.