# CVE-2026-104112: illumos nscd unbounded file descriptor allocation

Source: https://junglewise.ai/threats/cve-2026-104112-a-missing-release-of-resources-in-the-illumos-name-service-cache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104112 · Severity: info · Published 2026-10-09

illumos's name service cache daemon (nscd) is a system service that handles network identity lookups for applications. An unprivileged local user can repeatedly pass unused file descriptors to nscd through inter-process communication, causing the daemon to exhaust kernel memory and become unresponsive, which can render all processes on the host unable to connect to network services.

Technologies: [Illumos](https://junglewise.ai/threats/technologies/illumos). Vendors: [Illumos](https://junglewise.ai/threats/vendors/illumos).

## Quick answers

**Is CVE-2026-104112 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104112 being exploited in the wild.

**How severe is CVE-2026-104112?** Informational severity, published 9 October 2026.

**Which products and versions are affected?** Illumos prior to illumos-gate commit af810a72.

**Is there a fix for CVE-2026-104112?** Yes: fixed in illumos-gate commit af810a72. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104112 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-104112?** Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in illumos-gate commit af810a72

## Technical details

The nscd door server procedure switcher() in usr/src/cmd/nscd/nscd_frontend.c fails to close file descriptors passed via door_call() that are not used by the request. Since nscd runs with unlimited file descriptor limits and its main door at /var/run/name_service_door accepts descriptors from any local user, an attacker can trigger unbounded allocation of file descriptors in kernel memory via repeated door calls. A fix is available in illumos-gate commit af810a72.

## Affected products

- illumos illumos prior to illumos-gate commit af810a72

## Timeline

- 2026-10-09: disclosed: CVE-2026-104112 published
- 2026-10-06: patched: illumos-gate commit af810a72 merged
- 2006: other: Vulnerability introduced in illumos-gate commit cb5caa98

## References

- [https://illumos.org/](https://illumos.org/)
- [https://github.com/illumos/illumos-gate/commit/af810a72c09944e884ec695e8dbf1702a4f424ae](https://github.com/illumos/illumos-gate/commit/af810a72c09944e884ec695e8dbf1702a4f424ae)

## Related threats

- [illumos ipmgmtd missing authorization check in IPMP configuration](https://junglewise.ai/threats/cve-2026-104117-a-missing-authorization-check-in-the-illumos-ip-management)
- [illumos zones statistics daemon authorization bypass](https://junglewise.ai/threats/cve-2026-104116-a-missing-authorization-check-in-the-illumos-zones-statistics)
- [illumos reparse point daemon stack buffer overflow](https://junglewise.ai/threats/cve-2026-104115-a-stack-based-buffer-overflow-in-the-illumos-reparse-point)
- [illumos bhyve instruction emulator assertion denial of service](https://junglewise.ai/threats/cve-2026-102916-a-reachable-assertion-in-the-illumos-bhyve-instruction-emulator)