NULL Pointer Dereference Vulnerability in illumos Network Auto-Magic Daemon

CVE-2026-104114

What is CVE-2026-104114?

A NULL pointer dereference vulnerability in the illumos Network Auto-Magic daemon (nwamd) can be exploited by local users to crash the daemon, interrupting network configuration services. This occurs when nwamd_door_switch() processes requests without validating supplied arguments or user credentials, allowing unprivileged users to issue door_call() commands without proper data. Repeated exploitation leads to the svc:/network/physical:nwam service entering maintenance mode, which halts the automatic network configuration process. This vulnerability has existed since 2010 and impacts all illumos distributions prior to a specific code commit.

References