CVE-2026-104114: CWE-476 NULL Pointer Dereference in illumos illumos-gate

The vulnerability arises from the nwamd_door_switch() function in illumos-gate, which writes to the caller's request structure without verifying that the request data is present or checking caller credentials. Since the nwamd door is accessible to all local users, an unprivileged user can trigger a NULL pointer dereference by issuing a door_call() without arguments. This causes the nwamd daemon to crash, and repeated exploitation places the svc:/network/physical:nwam service into maintenance mode, disabling automatic network configuration. The flaw has been present since the illumos-gate commit 6ba597c5 (2010) and is resolved in commit 0f1064d9.

An unprivileged local user can cause a denial of service by crashing the nwamd daemon, which results in the network auto-configuration service entering maintenance mode and ceasing to function. This may disrupt network management on affected systems where the nwamd service is enabled.

A fix is available in illumos-gate as of commit 0f1064d9. Users should update to a version including this commit to remediate the vulnerability. Note that the nwamd service is not enabled by default; disabling this service if not required can also mitigate exposure.