CVE-2026-104112: CWE-772 Missing Release of Resource after Effective Lifetime in illumos illumos-gate

The vulnerability arises from the nscd door server procedure switcher() not closing file descriptors passed with a door call if they are unused by the request. Since nscd accepts descriptors from any user in its zone and runs with an unlimited file descriptor limit, an unprivileged local user can repeatedly pass descriptors in a door_call() loop. This causes the file descriptor table of nscd to grow indefinitely in kernel memory, leading to resource exhaustion and denial of service. The issue has been present since 2006 and is fixed in illumos-gate commit af810a72.

An unprivileged local user, including those in non-global zones, can exhaust kernel memory by causing nscd to leak file descriptors. This results in denial of service of the nscd daemon and can make processes in all zones on the host unresponsive. There is no indication of privilege escalation or remote exploitation. The impact is limited to local denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict local user access to the system and monitor for unusual resource usage related to nscd. Since the vulnerability requires local access and repeated door calls, limiting untrusted local user activity can mitigate risk.