CVE-2026-104115 is a stack-based buffer overflow vulnerability in the illumos reparse point daemon (reparsed). It allows a local user to crash the daemon by sending an nfs-basic request with an overlong host or path component. The flaw arises because the daemon copies these components into a fixed 1024-byte stack buffer without length checks. Systems built with stack protection will abort the daemon on overflow, causing the related filesystem reparse service to enter maintenance mode. This service is disabled by default. The vulnerability has existed since 2009 and affects illumos distributions prior to a specific commit fixing the issue.
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb5caa98), and affects any illumos distribution prior to illumos-gate commit af810a72.
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the ZSD_CMD_NEW_ZONE command, which is intended to be sent by zoneadmd, without checking the caller's credentials. Because the zonestatd door is accessible to all users in every zone, an unprivileged user can send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, so that new zonestat requests in that zone can fail while the file is replaced. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone. The flaw has existed since 2010 (illumos-gate commit efd4c9b6), and affects any illumos distribution prior to illumos-gate commit 865b58d2.
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.
CVE-2026-102916 is a reachable assertion vulnerability in the illumos bhyve instruction emulator that allows a guest VM to cause the host to panic. The issue arises when emulating REP-prefixed MOVS or STOS instructions accessing guest MMIO, where a status flag is not cleared properly, leading to a VERIFY assertion failure and host panic. A privileged user inside a guest VM can exploit this to cause denial of service to the host and all other guests. The flaw has existed since 2020 and affects illumos distributions prior to a specific commit fixing the issue.
A heap-based buffer overflow vulnerability exists in the illumos SCTP inbound path due to improper validation of address parameters in INIT ACK chunks during association lookup. This flaw allows a remote, unauthenticated attacker to send a crafted SCTP INIT ACK packet that causes out-of-bounds memory access and kernel heap corruption, potentially leading to remote code execution. The vulnerability has been present since 2010 and affects illumos distributions prior to a specific commit fix. The CVSS 4.0 score is 9.1, indicating critical severity.
CVE-2026-15449 is a medium-severity TOCTOU race condition vulnerability in the illumos-gate operating system's data-link pseudo-driver (dld). It affects the handling of specific ioctls on /dev/dld, allowing an unprivileged local user to cause kernel heap corruption and potentially panic the system. The flaw arises from a race condition during copying of ioctl data, leading to a buffer overflow in kernel memory. No patch or official remediation is currently confirmed.