Story · 1 source · 2 articlesfirst Oct 9, 19:47 UTCupdated Oct 9, 19:49 UTC (23h ago)

illumos discloses door-server CVEs and a bhyve bug

mediumVulnerabilityimportance 42CVE-2026-102916 CVE-2026-104112 CVE-2026-104113 CVE-2026-104117

What's new: First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrives

illumos disclosed door-server DoS and authorization CVEs plus a bhyve REP-prefix flag bug, with no exploitation reported.

On 9 October 2026, oss-security carried two separate illumos disclosures. Dan McDonald reported door-server issues spanning CVE-2026-104112 through CVE-2026-104117, covering denial of service and missing authorization in nscd and ipmgmtd. CVE-2026-104112 (bug 18494) is unbounded file-descriptor allocation in nscd, while CVE-2026-104113 is an ipmgmtd double-free of caller credentials after an authorization failure and is limited to OmniOS and SmartOS rather than general illumos. Separately, illumos reported CVE-2026-102916 (bug 18491), in which bhyve virtual machine monitor emulation of REP-prefix instructions mishandles CPU flags. Emily Albini of Oxide Computer discovered that flaw and iximeow of Oxide Computer fixed it. Neither notice describes exploitation, and the reports do not conflict because they cover different components.

Dan McDonald reported illumos door-server CVEs CVE-2026-104112 through CVE-2026-104117 covering denial of service and missing authorization.
CVE-2026-104112 (bug 18494) is unbounded file-descriptor allocation in nscd.
CVE-2026-104113 is an ipmgmtd double-free of caller credentials after authorization failure, limited to OmniOS and SmartOS rather than general illumos.
CVE-2026-102916 (illumos bug 18491) is a bhyve VMM flaw in which REP-prefix instruction emulation mishandles CPU flags.
Emily Albini of Oxide Computer discovered CVE-2026-102916; iximeow of Oxide Computer fixed it.
Neither notice states active or in-the-wild exploitation.
Both oss-security reports are dated 2026-10-09.

Vendorsillumos

Productsbhyve nscd ipmgmtd

OrganizationsOxide Computer illumos OmniOS SmartOS

Coverage timelineoldest first · each row is one article

Oct 9, 19:47 UTC · 23h ago
oss-security· 40
Multiple CVEs for illumos and distros: door server processes
illumos reported door-server CVEs causing denial of service and missing authorization in nscd and ipmgmtd.
Oct 9, 19:49 UTC · 23h ago
oss-security· 42
CVE for illumos and distros: VMM/BHYVE
illumos disclosed CVE-2026-102916, a bhyve REP-prefix emulation bug that mishandles CPU flags.

Vulnerabilities in this storyAll →

CVE-2026-1029166.8—
Guest-triggered host panic in illumos bhyve emulator
published 1d ago· illumos-gate (bhyve / vmm instruction emulator)
CVE-2026-1041126.8—
FD leak in illumos nscd allows local kernel memory exhaustion
published 1d ago· illumos nscd (name service cache daemon)
CVE-2026-104113

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2026-102916	Guest-triggered host panic in illumos bhyve emulator A reachable assertion in the illumos bhyve instruction emulator lets a guest panic the host. When the kernel emulates a REP-prefixed MOVS or STOS that touches guest MMIO, vie_emulate_movs() and vie_emulate_stos() leave the VIES_REPEAT flag set on the last iteration; for kernel-emulated regions (local APIC, I/O APIC, and HPET) that stale flag fails a VERIFY check in vie_advance_pc(). A privileged user inside a guest can aim REP MOVS or REP STOS at the local APIC page and cause a denial of service of the host and every other guest on it. The bug has been present since illumos-gate commit e0c0d44e in 2020 and affects any illumos distribution older than commit 696ecf8d. It is not in CISA KEV, and no public proof-of-concept is known. Do: Update illumos-gate to commit 696ecf8d or later, or install the corresponding illumos distribution update that includes that fix, on every bhyve host. Until patched, do not run untrusted guests and limit who can execute privileged code inside VMs, because a guest administrator can panic the host. After patching, reboot hosts so the corrected VMM emulator is loaded.	6.8	—	illumos-gate (bhyve / vmm instruction emulator) Builds containing commit e0c0d44e (introduced 2020) and earlier than the fix in commit 696ecf8d illumos distributions illumos-based distributions shipping the affected bhyve/vmm code Any distribution build based on illumos-gate prior to commit 696ecf8d	niche	1d ago
CVE-2026-104112	FD leak in illumos nscd allows local kernel memory exhaustion The illumos name service cache daemon (nscd) does not release file descriptors that a door client passes but the request does not use. switcher() in usr/src/cmd/nscd/nscd_frontend.c leaves those descriptors open, and the main door at /var/run/name_service_door accepts them from any user in the zone. An unprivileged local user, including one in a non-global zone, can loop door_call() and pass descriptors so nscd's unlimited file-descriptor table grows without bound in kernel memory. That denies service to nscd and can make processes in every zone on the host unresponsive. The bug has existed since 2006 and affects every illumos distribution before illumos-gate commit af810a72; no public proof-of-concept is known and it is not in the CISA KEV catalog. Do: Install an illumos build that includes illumos-gate commit af810a72 (or a distribution package that backports it) and restart nscd. Until then, restrict local and non-global-zone logins that can call the name-service door, and watch nscd's open file-descriptor count and kernel memory; restarting nscd frees leaked descriptors but does not fix the leak.	6.8	—	illumos nscd (name service cache daemon) Any illumos distribution before illumos-gate commit af810a72 (present since commit cb5caa98 in 2006)	nichelow thousands of hosts (order-of-magnitude estimate; illumos-family systems)	1d ago
CVE-2026-104113	Double-free crash in OmniOS and SmartOS ipmgmtd A double-free (CWE-415) in the IP management daemon ipmgmtd on OmniOS and SmartOS lets an unprivileged local user crash the daemon. When a door request that changes interface configuration is processed, ipmgmt_handler() frees the caller's credential with ucred_free() immediately after reading the user ID, then frees it again on the error path if the caller lacks solaris.network.interface.config (for example an IPMGMT_CMD_RESETIF request). The abort can be repeated until svc:/network/ip-interface-management goes to maintenance, blocking IP interface configuration; there is no confidentiality or integrity impact (CVSS 4.0 5.4). The early free was added in 2014 for lx-branded zones (OmniOS commit 4c170900) and is absent from upstream illumos-gate, so OmniOS r151020 and later and SmartOS builds before the fix are affected. No public proof of concept is listed and the issue is not in CISA KEV, although the CVSS vector marks exploit maturity as E:P. Do: Install the OmniOS and SmartOS updates that remove the extra ucred_free() in ipmgmtd; the advisory does not name a fixed build, so confirm the fix is in the release you deploy. Upstream illumos-gate is not affected. Until patched, limit unprivileged local accounts and alert if svc:/network/ip-interface-management enters maintenance.	5.4	—	OmniOS r151020 and later, prior to the fix Joyent SmartOS versions prior to the fix (not present in upstream illumos-gate)	nichelow thousands of specialized servers (order-of-magnitude estimate)
CVE-2026-104117	Missing authorization in illumos ipmgmtd IPMP config A missing authorization check in the illumos IP management daemon (ipmgmtd) lets an unprivileged local user change the persistent IP multipathing (IPMP) configuration. The door dispatch path for IPMGMT_CMD_IPMP_UPDATE does not require the solaris.network.interface.config authorization, so ipmgmt_ipmp_update_handler() can write the stored ipadm configuration when the IPMGMT_PERSIST flag is set and add interfaces to, or remove them from, existing IPMP groups. The running configuration is not changed immediately; the altered stored config is applied later, such as at boot, and can disrupt network connectivity. The bug has been present since illumos-gate commit a73be61a in 2021 and affects any illumos distribution built before commit e8d3efa1. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Update any illumos-based system to a build that includes illumos-gate commit e8d3efa1 or later, using the fixed packages from your distribution (OpenIndiana, OmniOS, SmartOS, and others track illumos-gate separately; no single version number is given). Until then, limit local unprivileged accounts and review stored ipadm/IPMP configuration for unexpected interface membership before the next reboot or config apply.	1.9	—	illumos (ipmgmtd / illumos-gate) All illumos distributions built before illumos-gate commit e8d3efa1; flaw present since commit a73be61a (2021)	niche	1d ago