CVE-2026-104116: CWE-862 Missing Authorization in illumos illumos-gate

The vulnerability CVE-2026-104116 in illumos-gate involves a missing authorization check in the zonestatd daemon's door server procedure zsd_server() when processing the ZSD_CMD_NEW_ZONE command. Since the zonestatd door is accessible to all users in every zone, an unprivileged local user can send this command with an arbitrary zone ID. This causes zonestatd to recreate its door file in the targeted zone, potentially causing new zonestat requests in that zone to fail during the replacement. Additionally, the time taken to process the command leaks information about which zones are currently running. The flaw has been present since 2010 and affects all illumos distributions before the illumos-gate commit 865b58d2, which addresses the issue.

An unprivileged local user in any zone can disrupt zonestat functionality in other zones by causing the zonestatd door file to be recreated, leading to potential denial of service for zonestat requests in those zones. Furthermore, the timing of the command handling can be used to determine which zones are active, potentially leaking information about the system's zone configuration. The impact is limited to local users and does not allow privilege escalation or remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in illumos-gate commit 865b58d2, applying this or a later update that includes this commit will remediate the issue. Until patched, restrict local user access to zones where possible to limit exploitation.