# CVE-2026-104113: OmniOS ipmgmtd double free in credential handling

Source: https://junglewise.ai/threats/cve-2026-104113-a-double-free-in-the-ip-management-daemon-ipmgmtd-of-omnios-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104113 · Severity: info · Published 2026-10-09

The IP management daemon (ipmgmtd) in OmniOS and SmartOS has a double-free vulnerability in how it handles user credentials when processing interface configuration requests. An unprivileged local user can trigger this flaw to crash the daemon and disrupt network interface management services on the system.

Technologies: [OmniOS](https://junglewise.ai/threats/technologies/omnios). Vendors: [OmniOS](https://junglewise.ai/threats/vendors/omnios).

## Quick answers

**Is CVE-2026-104113 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104113 being exploited in the wild.

**How severe is CVE-2026-104113?** Informational severity, published 9 October 2026.

**Which products and versions are affected?** OmniOS r151020 and later; Triton SmartOS prior to fix.

**Is there a fix for CVE-2026-104113?** Yes: fixed in OmniOS commit 670d853f335203ce8a66126cdbb25bfdba973036. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104113 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-104113?** Check whether you run OmniOS or Triton SmartOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OmniOS commit 670d853f335203ce8a66126cdbb25bfdba973036

## Technical details

A double free occurs in ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c when processing door requests that modify interface configuration. The function frees the caller's credential with ucred_free() immediately after extracting the user ID, then frees it again on the error path if authorization checks fail. An unprivileged local user without solaris.network.interface.config authorization can trigger this via requests like IPMGMT_CMD_RESETIF, causing ipmgmtd to abort and the IP interface management service to enter maintenance mode.

## Affected products

- OmniOS OmniOS r151020 and later
- Triton SmartOS prior to fix

## Timeline

- 2026-10-09: disclosed

## References

- [https://github.com/TritonDataCenter/illumos-joyent/commit/TBD](https://github.com/TritonDataCenter/illumos-joyent/commit/TBD)
- [https://github.com/omniosorg/illumos-omnios/commit/670d853f335203ce8a66126cdbb25bfdba973036](https://github.com/omniosorg/illumos-omnios/commit/670d853f335203ce8a66126cdbb25bfdba973036)

## Related threats

- [illumos data-link pseudo-driver TOCTOU heap overflow in dld ioctls](https://junglewise.ai/threats/cve-2026-15449-illumos-data-link-pseudo-driver-toctou-heap-overflow-in-dld)
- [illumos SCTP heap corruption in INIT ACK processing](https://junglewise.ai/threats/cve-2026-15422-illumos-sctp-heap-corruption-in-init-ack-processing)