CVE-2026-104115: CWE-121 Stack-based Buffer Overflow in illumos illumos-gate

This vulnerability is a stack-based buffer overflow in the illumos reparse point daemon (reparsed), specifically in the get_fs_locations() function of the nfs-basic reparse plugin. The function copies host and path components of a reparse string into a fixed 1024-byte stack buffer without validating their length. The reparsed door at /var/run/reparsed_door is accessible to all users and does not verify caller credentials, allowing any local user to send crafted requests that overflow the buffer. On systems with stack protection enabled (default), this causes the daemon to abort, placing the svc:/system/filesystem/reparse service into maintenance. The service is disabled by default. The flaw has been present since 2009 and affects illumos distributions prior to commit 6a2df4aa.

An unprivileged local user can cause a denial of service by crashing the reparsed daemon through a stack-based buffer overflow. This results in the filesystem reparse service entering maintenance mode, potentially disrupting related filesystem operations. There is no indication of privilege escalation or remote exploitation. The service is disabled by default, limiting exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the service is disabled by default, ensuring it remains disabled if not needed reduces risk. Systems built with stack protection will abort the daemon on exploitation, limiting impact to denial of service. Monitor vendor advisories for updates or patches addressing this issue.