illumos nwamd CVE-2026-104114

Requires (1) an authenticated local user account on the host - the nwam_door at /etc/svc/volatile/nwam/nwam_door is world-accessible to all local users, so no special privileges or group membership are needed; and (2) the svc:/network/physical:nwam (Network Auto-Magic) service must be ENABLED, which is explicitly NOT the illumos default - hosts using fixed/manual network configuration do not run nwamd and are entirely unexposed. Affected versions are any illumos distribution built before illumos-gate commit 0f1064d9 (the flaw dates to commit 6ba597c5 in 2010). No remote access, no user interaction, and no second victim are involved; the limiting factors are the local-access requirement and the non-default service state.

This is a genuinely low-to-moderate priority issue despite its CWE-476 NULL pointer dereference classification, and the signals are internally consistent. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) correctly reflects that exploitation requires an authenticated local user (PR:L) rather than remote network access, and the only impact is availability (VA:H) - there is no confidentiality or integrity loss (VC:N/VI:N). The vector carries E:P (Proof-of-Concept exploit maturity), and the description itself functions as a reproduction recipe (an unprivileged door_call() with no argument data), so working exploit code is trivially derivable; however, there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - consistent with a local-only denial-of-service against a non-default service. The most important risk-limiting fact is that nwamd only runs when svc:/network/physical:nwam is enabled, which is NOT the default illumos configuration, so most deployments are not exposed at all. Net: a real, confirmed local DoS worth patching on systems that actually run NWAM, but not an emergency and not relevant to default-configured hosts.

An unprivileged local user on an illumos/OmniOS host that has the NWAM service enabled issues a door_call() to /etc/svc/volatile/nwam/nwam_door with no argument data; because nwamd_door_switch() writes to the caller's request structure before null-checking it, the daemon dereferences a NULL pointer and crashes. The description provides a complete reproduction method (proof-of-concept per CVSS E:P), and repeating the call drives svc:/network/physical:nwam into the maintenance state, disabling automatic network configuration.