CVE-2026-104113 Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon

A double free in the IP management daemon ipmgmtd of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmthandler in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c frees the caller's credential with ucredfree...

CVE-2026-104113

A double free vulnerability exists in the ipmgmtd IP management daemon of OmniOS (r151020 and later) and SmartOS (prior to the fix). The flaw is located in ipmgmt_handler() within usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c, where the system calls ucred_free() immediately after reading the use...