CVE-2026-104114 NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon
Local unprivileged users can crash the illumos nwamd daemon via a NULL pointer dereference, disrupting automatic network configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104114?
CVE-2026-104114 is a medium-severity vulnerability in OmniOS, published on 9 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.
Weakness: CWE-476
Which versions are affected by CVE-2026-104114?
How do I fix CVE-2026-104114?
No fix has been published for CVE-2026-104114 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104114 being exploited?
There is no known exploitation of CVE-2026-104114 in the wild and no public exploit code.
Sources
Also known as GHSA-pc4c-24x9-97jq.