Description
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb5caa98), and affects any illumos distribution prior to illumos-gate commit af810a72.
Published: 2026-10-09
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Update
AI Analysis

Impact

A missing release of file descriptors in the illumos name service cache daemon allows a local user to trigger a denial of service by exhausting kernel memory. The flaw is caused by the door server procedure that accepts and retains passed descriptors without closing them, causing the nscd process’s file descriptor table to grow without bound. This memory exhaustion can render nscd, and consequently subsystems in all zones on the host, unresponsive. The weakness is an instance of improper resource release (CWE-772).

Affected Systems

This vulnerability affects OmniOS and illumos distributions that include the illumos-gate source. Any illumos edition released before the illumos-gate commit af810a72 is vulnerable, including older OmniOS releases. Non‑global zones are impacted because the nscd door accepts descriptors from any zone user, and the daemon runs with an unlimited file descriptor limit.

Risk and Exploitability

The patch score is 6.8 on CVSS, indicating a moderate severity. EPSS data is not available, so exploitation likelihood is not quantified, but the flaw has existed since 2006 and is not listed in CISA's KEV catalog. Attackers need local user access on the host or within a zone; they can repeatedly call door_call() with a descriptor, causing the descriptor table to grow until kernel memory is exhausted. The worm‑like nature of the attack means resetting the host is likely required to restore service.

Generated by OpenCVE AI on October 9, 2026 at 15:42 UTC.

Remediation

Vendor Solution

Update your illumos distribution to one that includes the fix for this issue.

Vendor Workaround

One can mitigate by disabling the name-service-cache SMF service in every affected zone, but once upgraded that service should be re-enabled.

OpenCVE Recommended Actions

  • Update the illumos distribution to a version that includes the fix for this issue
  • If an update is not immediately available, temporarily disable the name-service-cache SMF service in each affected zone; after applying the update, re‑enable the service
  • Ensure that zones restricting file descriptor passing to nscd by applying stricter admin privileges or adjusting resource limits so that unprivileged users cannot repeatedly inject descriptors

Generated by OpenCVE AI on October 9, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Illumos
Illumos illumos-gate
Omnios
Omnios omnios
Vendors & Products Illumos
Illumos illumos-gate
Omnios
Omnios omnios

Fri, 09 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb5caa98), and affects any illumos distribution prior to illumos-gate commit af810a72.
Title Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory
Weaknesses CWE-772
References
Metrics cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P'}

Subscriptions

Illumos Illumos-gate
Omnios Omnios
cve-icon MITRE

Status: PUBLISHED

Assigner: illumos

Published:

Updated: 2026-10-09T16:45:36.172Z

Reserved: 2026-10-01T18:07:53.956Z

Link: CVE-2026-104112

cve-icon Vulnrichment

Updated: 2026-10-09T16:15:18.920Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-09T15:17:07.100

Modified: 2026-10-09T17:16:44.340

Link: CVE-2026-104112

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T15:45:07Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime