CVE-2026-104114
Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in illumos nwamd

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: illumos

Description
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-104114
EUVD
EUVD-2026-95802

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
illumos illumos-gate 6ba597c56d749c61b4f783157f63196d7b2445f0
OmniOS OmniOS any
OmniOS OmniOS r151058
OmniOS OmniOS r151056
OmniOS OmniOS r151054

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd). It allows a local user to crash the daemon by sending an empty request to the nwamd door service. The flaw exists because the daemon writes to a request structure without first verifying the request exists or checking user credentials. Repeated crashes can stop automatic network configuration.

Detection Guidance

Check if the nwamd service is running with: svcs -a | grep nwam. Verify if the door file exists at /etc/svc/volatile/nwam/nwam_door. Test for crashes in nwamd by monitoring service logs with: svcadm log svc:/network/physical:nwam.

Impact Analysis

If you are using an affected illumos distribution, an unprivileged local attacker could crash the nwamd service repeatedly, causing the network configuration service to enter maintenance mode. This would stop automatic network configuration until manually restarted, potentially disrupting network connectivity.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the nwamd service, which may disrupt network configuration. It does not directly impact data confidentiality or integrity, so its effect on GDPR or HIPAA compliance is likely minimal unless network outages lead to secondary compliance failures.

Mitigation Strategies

Disable the nwam service if not needed with: svcadm disable svc:/network/physical:nwam. Apply the patch from illumos-gate commit 0f1064d9 to validate door requests. Restrict access to the door file if the service must run.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart