CVE-2026-104112

Name of the Vulnerable Software and Affected Versions illumos distributions prior to illumos-gate commit af810a72

Description A resource leak in the name service cache daemon (nscd) allows a local user to exhaust kernel memory. The switcher() function in usr/src/cmd/nscd/nscd frontend.c fails to close file descriptors passed via a door call that are not used by the request. Since the main nscd door at '/var/run/name service door' accepts descriptors from any user in its zone and operates with an unlimited file descriptor limit, an unprivileged local user can trigger a door call() loop to grow the nscd file descriptor table without bound. This results in a denial of service for nscd and may cause processes across all zones on the host to become unresponsive.

Recommendations Update illumos distributions to version illumos-gate commit af810a72 or later.