CVE-2026-104113

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-104113

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104113.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-104113

Published

2026-10-09T14:17:00Z

Modified

2026-10-11T07:00:57Z

Severity

5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon

Details

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

Database specific

{
    "cna_assigner": "illumos",
    "cwe_ids": [
        "CWE-415"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104113.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "r151058"
                },
                {
                    "fixed": "r151058w"
                },
                {
                    "introduced": "r151056"
                },
                {
                    "fixed": "r151056aw"
                },
                {
                    "introduced": "r151054"
                },
                {
                    "fixed": "r151054bw"
                },
                {
                    "introduced": "r151020"
                },
                {
                    "fixed": "r151054"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/omniosorg/illumos-omnios

Affected ranges

Type

GIT

Repo

https://github.com/omniosorg/illumos-omnios

Events

Introduced

Fixed

670d853f335203ce8a66126cdbb25bfdba973036

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

Other

onnv_

onnv_100

onnv_101

onnv_102

onnv_103

onnv_104

onnv_105

onnv_106

onnv_107

onnv_108

onnv_109

onnv_110

onnv_111

onnv_112

onnv_113

onnv_114

onnv_115

onnv_116

onnv_117

onnv_118

onnv_119

onnv_120

onnv_121

onnv_122

onnv_123

onnv_124

onnv_125

onnv_126

onnv_127

onnv_128

onnv_129

onnv_130

onnv_131

onnv_132

onnv_133

onnv_134

onnv_135

onnv_136

onnv_137

onnv_138

onnv_139

onnv_140

onnv_141

onnv_142

onnv_143

onnv_144

onnv_18

onnv_19

onnv_20

onnv_21

onnv_22

onnv_23

onnv_24

onnv_25

onnv_26

onnv_27

onnv_28

onnv_29

onnv_30

onnv_31

onnv_32

onnv_33

onnv_34

onnv_35

onnv_36

onnv_37

onnv_38

onnv_39

onnv_40

onnv_41

onnv_42

onnv_43

onnv_44

onnv_45

onnv_46

onnv_47

onnv_48

onnv_49

onnv_50

onnv_51

onnv_52

onnv_53

onnv_54

onnv_55

onnv_56

onnv_57

onnv_58

onnv_59

onnv_60

onnv_61

onnv_62

onnv_63

onnv_64

onnv_65

onnv_66

onnv_67

onnv_68

onnv_69

onnv_70

onnv_71

onnv_72

onnv_73

onnv_74

onnv_75

onnv_76

onnv_77

onnv_78

onnv_79

onnv_80

onnv_81

onnv_82

onnv_83

onnv_84

onnv_85

onnv_86

onnv_87

onnv_88

onnv_89

onnv_90

onnv_91

onnv_92

onnv_93

onnv_94

onnv_95

onnv_96

onnv_97

onnv_98

onnv_99

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104113.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "298381756739132767320796100954115260494",
                "133019350961963087075150217541824466935",
                "324640063200016750816945259360219319187",
                "2337954271442398907744236231188024279",
                "128787396011463472516764321029087614799",
                "273097059712255288959238292389125933310",
                "4727405014489457474081475550178203966",
                "191244543335672928605256189356186263098"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-104113-a97614f3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/omniosorg/illumos-omnios/commit/670d853f335203ce8a66126cdbb25bfdba973036",
        "target": {
            "file": "usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "338343569368610172075324576610663289242",
            "length": 1345
        },
        "id": "CVE-2026-104113-c48566aa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/omniosorg/illumos-omnios/commit/670d853f335203ce8a66126cdbb25bfdba973036",
        "target": {
            "file": "usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c",
            "function": "ipmgmt_handler"
        }
    }
]

vanir_signatures_modified

"2026-10-11T07:00:57Z"