illumos nscd CVE-2026-104112

Requires a local, authenticated but unprivileged account on an illumos/OmniOS host (PR:L), including merely an account inside a non-global zone, since the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. The specific trigger is repeatedly invoking door_call() against that door while passing a file descriptor the request does not use, exploiting that switcher() in nscd_frontend.c fails to close such descriptors and that nscd runs with an unlimited file-descriptor limit. Limiting factors: no remote vector (local access mandatory), no exploitation of default network services, impact is denial-of-service only with no data exposure, and the system must be running an illumos distribution built before illumos-gate commit af810a72; patched builds cap passed descriptors to one (DOOR_PARAM_DESC_MAX=1) and close unused descriptors, closing the vector.

All signals converge on this being a genuine but bounded local availability threat rather than a mass-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms a local attacker needs only a low-privileged account and faces low attack complexity with no user interaction, and the impact is purely availability (VC:N/VI:N/VA:H with subsequent-system SA:H), consistent with the CWE-772 resource-exhaustion description - there is no confidentiality or integrity exposure. The notable risk amplifier is scope: because nscd runs with an unlimited file-descriptor limit and its door accepts descriptors from any user in the zone, an unprivileged user in a single non-global zone can hang nscd for processes across all zones on the host (hence SA:H). CVSS exploit maturity is E:P (proof-of-concept), the vulnerability is NOT in CISA KEV, and no EPSS score was provided; there is no evidence of active or widespread exploitation. The CVSS vector and the textual description agree (both indicate local, low-privilege, availability-only), so no signal conflict exists. Net: a legitimate patch-worthy DoS in multi-tenant/zone environments, but low urgency relative to network-exploitable or RCE issues, and constrained to platforms with an attacker-controlled local account.

An unprivileged user with shell access in a non-global zone writes a small program that opens a file descriptor and repeatedly issues door_call() to /var/run/name_service_door, passing the descriptor each time. Because switcher() never closes descriptors the request does not consume and nscd has no fd limit, nscd's file-descriptor table grows unbounded in kernel memory until nscd becomes unresponsive, degrading name-service lookups for processes in every zone on the host. CVSS reports proof-of-concept exploit maturity (E:P); no weaponized or in-the-wild exploit is confirmed.