CVE-2026-104112

A moderate denial of service vulnerability was found in the illumos name service cache daemon (nscd). The nscd door server procedure switcher() in usr/src/cmd/nscd/nscd_frontend.c does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local attacker, including one in a non-global zone, can repeatedly pass file descriptors to nscd in a door_call() loop, causing the nscd file descriptor table to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. illumos is not a component shipped in any Red Hat product, and no Red Hat products are currently listed as affected by this flaw. Red Hat rates this flaw as Moderate impact (CVSS 3.1 score 5.5); the upstream CVE record scores it 6.8 under CVSS 4.0, reflecting its assessment of availability impact to the broader system, but both assessments correspond to Moderate severity.