Is CVE-2026-104112 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104112 being exploited in the wild.

How severe is CVE-2026-104112?

Informational severity, published 9 October 2026.

Which products and versions are affected?

Illumos prior to illumos-gate commit af810a72.

Is there a fix for CVE-2026-104112?

Yes: fixed in illumos-gate commit af810a72. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104112 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-104112?

Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104112: illumos nscd unbounded file descriptor allocation

CVE-2026-104112 · Severity: info · Published 2026-10-09

illumos's name service cache daemon (nscd) is a system service that handles network identity lookups for applications. An unprivileged local user can repeatedly pass unused file descriptors to nscd through inter-process communication, causing the daemon to exhaust kernel memory and become unresponsive, which can render all processes on the host unable to connect to network services.

Technologies: Illumos. Vendors: Illumos.

Quick answers

Is CVE-2026-104112 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104112 being exploited in the wild.
How severe is CVE-2026-104112?: Informational severity, published 9 October 2026.
Which products and versions are affected?: Illumos prior to illumos-gate commit af810a72.
Is there a fix for CVE-2026-104112?: Yes: fixed in illumos-gate commit af810a72. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104112 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-104112?: Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: illumos-gate commit af810a72

Technical details

The nscd door server procedure switcher() in usr/src/cmd/nscd/nscd_frontend.c fails to close file descriptors passed via door_call() that are not used by the request. Since nscd runs with unlimited file descriptor limits and its main door at /var/run/name_service_door accepts descriptors from any local user, an attacker can trigger unbounded allocation of file descriptors in kernel memory via repeated door calls. A fix is available in illumos-gate commit af810a72.

Affected products

illumos illumos prior to illumos-gate commit af810a72

Timeline

2026-10-09: disclosed: CVE-2026-104112 published
2026-10-06: patched: illumos-gate commit af810a72 merged
2006: other: Vulnerability introduced in illumos-gate commit cb5caa98

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.