OmniOS CVE-2026-104113

Requires an unprivileged local account on an affected host (OmniOS r151020 or later, or SmartOS, prior to the fix) with the ability to send door requests to the ipmgmtd door; the attacker specifically does NOT need the solaris.network.interface.config authorization, and the crash is triggered precisely on the authorization-FAILURE error path via a config-modifying command such as IPMGMT_CMD_RESETIF. Limiting factors: exploitation is LOCAL only (no network vector), needs a valid local login, and impacts only availability of IP interface management (no data exposure or code execution). Notably, upstream illumos-gate is NOT affected because the offending early ucred_free() was introduced by OmniOS commit 4c170900 (2014) for lx-branded zones, so vanilla illumos distributions outside this lineage are out of scope.

Signals point to a moderate, bounded availability risk rather than a top-tier priority. The CVSS 4.0 base of 5.4 is driven entirely by VA:H (availability of the vulnerable system) with VC:N/VI:N - there is no confidentiality or integrity impact and no code execution; the worst outcome is denial of IP interface management. The vector's AV:L and PR:L confirm this is a LOCAL, authenticated (low-privilege) attack: the attacker must already hold an account/shell on the host, which sharply limits exposure versus a network-reachable flaw. AC:L and AT:N mean the trigger is trivial and reliable once local access exists. The vector carries E:P (Exploit Maturity = Proof-of-Concept), suggesting a PoC-grade trigger is understood, but no standalone exploit link is provided. EPSS is not supplied and the CVE is NOT in CISA KEV - consistent with a low-glamour local DoS unlikely to see mass exploitation. Net: this matters most in MULTI-TENANT illumos deployments (non-global/lx-branded zones, SmartOS/Triton hosts) where untrusted local users can degrade host IP configuration management; on single-administrator systems the practical risk is low. Gaps: no EPSS, no KEV, and only a vendor-claimed PoC maturity metric rather than published exploit code.

An unprivileged local user on an OmniOS (r151020+) or SmartOS host - for example a tenant inside a shared zone - who lacks the solaris.network.interface.config authorization sends a configuration-modifying door request such as IPMGMT_CMD_RESETIF to the ipmgmtd door. ipmgmtd frees the caller credential once after reading the UID and again on the authorization-failure error path, triggering a double free (CWE-415) that aborts the daemon. Repeating the request drives svc:/network/ip-interface-management into maintenance, blocking further IP interface configuration; the CVSS vector claims proof-of-concept maturity (E:P) though no standalone exploit is linked.