CVE-2026-104114: NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamddoorswitch() in usr/src/cmd/cmd-inet/lib/nwamd/doorif.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwamdoor is accessible to all local users, an unprivileged user can issue a doorcall() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
illumos-gateto a version that resolves this vulnerability.Patch 0f1064d9
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
Only systems with the svc:/network/physical:nwam service enabled are exposed, because nwamd runs only under that service. The service is not enabled by default, and affected systems are illumos distributions before illumos-gate commit 0f1064d9.
What access does an attacker need?
An attacker needs local access only; no elevated privileges are required. Any local user can access the nwamd door and issue a door_call() without argument data to crash the daemon.
What is the operational impact of repeated exploitation?
Repeated crashes place svc:/network/physical:nwam into maintenance mode. This stops automatic network configuration.
How can administrators check whether they are currently exposed?
Check whether svc:/network/physical:nwam is enabled and whether the installed illumos code includes illumos-gate commit 0f1064d9. If the service is enabled on code predating that commit, an unprivileged local user can trigger the condition.
What can be done if the fix cannot be applied immediately?
Disable svc:/network/physical:nwam if automatic network configuration is not required. This prevents nwamd from running and removes the reachable door handler from use.