CVE-2026-104113

A double free in the IP management daemon ipmgmtd of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmthandler in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c frees the caller's credential with ucredfree...

CVE-2026-104117

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

CVE-2026-104113

A double free vulnerability exists in the ipmgmtd IP management daemon of OmniOS (r151020 and later) and SmartOS (prior to the fix). The flaw is located in ipmgmt_handler() within usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c, where the system calls ucred_free() immediately after reading the use...

CVE-2026-104113 Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon

A double free in the IP management daemon ipmgmtd of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmthandler in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c frees the caller's credential with ucredfree...

EUVD-2026-95799

A double free in the IP management daemon ipmgmtd of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmthandler in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c frees the caller's credential with ucredfree...

CVE-2026-104117

A missing authorization check in the illumos IP management daemon (ipmgmtd ) allows an unprivileged local user to modify the persistent IP multipathing (IPMP) configuration. Specifically, the door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c fails to require solaris.network.in...

CVE-2026-104117 Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

EUVD-2026-95798

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...