illumos Security Information¶

Introduction¶

We take security issues seriously, and encourage users and developers alike to report them.

Disclosure policy¶

The illumos project supplies multiple downstream distributions, so a vulnerability in illumos must have its mitigations and fixes available to the distributions. Security vulnerabilities should be confidentially reported to [email protected], the security team. See https://illumos.org/docs/security/ for the appropriate keying information. We understand that such vulnerabilities may be (for multiple reasons) disclosed to the public. We need to address both possibilities.

IF A SECURITY REPORT IS SUBMITTED TO [email protected] WITH PROPER CONFIDENTIALITY:

The security team will analyze, confirm, and identify a solution, possibly with the help of distributions' security contacts or other experts.
If the report is on behalf of a distribution's downstream, the security team will determine if other distributions or illumos-gate itself have a similar issue.
The security team will reserve A CVE number, before public disclosure.
The security team will ensure a fix will be written, tested, reviewed, and approved for landing in illumos-gate, but will NOT land in illumos-gate immediately. At least one member of the security team will be involved in at least one of writing, testing, reviewing or approving.
The security team will contact distributions to coordinate a fix for illumos-gate, and for distributions' downstream children of illumos-gate. Some distributions have long-term support releases that may also be affected. The result of this coordination will include an embargo date.
On the embargo date the fix will land in illumos-gate. Any downstream distributions who coordinated can land in their downstreams of illumos-gate no earlier than when it lands in illumos-gate itself. The issue (with CVE number) will be announced to illumos-developer and any other appropriate @illumos.org emails. Distributions can inform their mailing lists distributions, or other mechanisms, no earlier than when the fix lands in illumos-gate. The CVE record will be fully updated no later than 48 hours after announcement.

IF A SECURITY VULNERABILITY IS PUBLICALLY DISCLOSED, REGARDLESS OF THE DISCLOSURE'S INTENT:

The security team will discuss as soon as possible what mitigations or fixes are either available, or need to be created.
The security team will inform distributions of the disclosure if they do not know already.
If a mitigation is available before a fix (e.g. a hotpatch, or a configuration of either illumos or networks feeding illumos instances), the security team will announce it as soon as possible.
The security team will themselves, or offer any aid in: writing, testing, reviewing, and integrating a fix as soon as possible while maintaining illumos code standards.
Once the fix lands in illumos-gate, all communications documented in #6 above not already done should happen immediately.

Reporting security incidents¶

Please send mail to [email protected]

pub   4096R/50ACC3EE 2025-08-04 [expires: 2028-08-28]
uid                  illumos security (For contacting the illumos security response team) <[email protected]>
sub   4096R/71437FCD 2025-08-04 [expires: 2028-08-28]

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGiQ/+0BEAC6jFY/BHnGhZb1ZtrUl8m7BiKZ+ZhSf6uSJei+MyVVaHhmi8Wr
+825IqZcBSQhu6Din+0bW21GSRxGPDCSD13wSbjWetm2eWOyPi5HXr9LJQCU6dVZ
+BrwrTNGIQUTw4UoBRo2hg6obuKy4qjdxyL1KPuKPZQqEVfDIRMZV7s0VtgyTxZB
1ppiL4wZOmSETlp7+suOhp4AGNVL8jLIepvVFmvJNBMambKiP1sFPlbrW5LxQ14W
ZuVUnW090RYfRtxFudvIgpx9F9eRZckcb4MM6wlxSQVvQ472qFGxIBBwVN9K4xlJ
mOkgWy9nm3k5+iCHFtiNLqg5vsjgGer0R0JOfTSyhfiJu3A1sfuIdNQmZZPgz09K
KTJsgo9pj7P6Va0MoEO8x2HXaaeJzioYQ+/mSymeYcBm4SlrcWcSfpWPAQoNqoD3
kpMjONmZ/B4vegTLDirn+MiYmU7msiGG4DMbi5i0JF7jmtQdH/siC1idAaLnUMbR
ceFCuNEeiZLVkmdGEIUgnxtn2uvLB6eDxVJ5B+FVwPz9X4QnP6wYOLqPdmkfUiLS
RYuOdlz+jC8pt0k0NhB5ZFpppi5hDCnoFlHmF/MMJme9UDxDpjfQKpdy5n+GvY3g
IBATGGYh41vy6rC1VzGoMZVvCvCVkHxcARpmI+RZWxEXgc/HBPl2HhBW+wARAQAB
tFtpbGx1bW9zIHNlY3VyaXR5IChGb3IgY29udGFjdGluZyB0aGUgaWxsdW1vcyBz
ZWN1cml0eSByZXNwb25zZSB0ZWFtKSA8c2VjdXJpdHlAaWxsdW1vcy5vcmc+iQI+
BBMBAgAoBQJokP/tAhsDBQkFxJAABgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAK
CRA/rdi0UKzD7qLXD/9V3YvW5EO6wNIPQsu2Qm8uCy11roo6WI6gQYcx1QYI5F5L
RSw43G7lDGGui4db0QoN8+i1PXkXHSk7brI8i54lIRpYdVu8PTjazHdj/8WhOs88
8hz1AtvOjXGEVMF8ZC1PaUPNCENwQHfKu392dHjqSKWTG88HoyrbQYRpC6uh7pft
le554hLCKBv3qdnCthnnyr3xAXBPcZDQrF5aj6roQxGvun/BZE0MgRDuYMXnZ8On
Q2o1n0s0zemmTO3PbkbQJw8wHrMSLtY83HuGjPQTSZHu8wUhw2Q7K12t637VCPXE
m+bcyo6qVxyVx7FH8C6+TxjB54Vbli80vILoquimSKjIhyUpwI2IjFUBQTX3PP66
2VBf7UIS2zCM9qNelqkcclW429STXGArnet67pZP1CWkl6Xf99LAoAZxtF0STO4E
tQASIIQJFeaveqFsCwPOAaPTyqvwbHVTsQsCFYpO8qQpJvAs3ONUvb1pkKybpk/k
tVOEqrPr0J1jMaJ8j5FT3xndvXRLzrsX4ER8UGmfRkdPtNz9BePuu0E7DqkASfTo
28VWwo0CrWZrMY80nOnrNoIPeLPfU94OxVMbSKnBN082QDs5dO2GzrChQ57mSm4v
MkwZ7+9obQbOYNj3aG67YgBkmwrQkFNf72P1JwzCG37izHRkRKegn5L5eAwGVrkC
DQRokP/tARAAn2Q1Xpu3e+T284aGKApsOGTKS+8z5wPE3QppY9twbXanjzm+NqTN
VvYs3TXKzUpEwG2OsKn0rS+24rF1rErfOfEXKE9Z0mzuEB5sOEvCVccjPNm5fVj1
q/tX1gOEb73k5cXpbWYetn+7moZ5mv2+RlZadNOC6T9Mf3Aqo1JGeaOQ+edk+BMw
jfFDyakYyxIwfrQKANAywLYEp7QKbW7S85xkIiqdq0JsfRGpZQB5sgwYE6McIeuI
lzl4HjFgMY5kZ3vX/HghGEcaXnDlMdtcb/8QaMEmxG1YXvRfaPp98m9QsC1QZoZE
6q/UtObRx8HdTEu5wqNPU7h7jfsd8zxmgwmLTX0ut/211AcrSB4tRruSJfikSl3t
cMDQnXzRpKWVBOgpMch8ssDrCOEZjER0Npip5Eias3lksXvoBjNGleTLk825POLo
5S3iAu0I7GjHwgiTwbgUAVbYxuSjlgWyW1atkf/FnzchMBz3i+Xgh+fh8+We0ZQq
ctRiTchU61MkcZV+SRBZ2FRpic5+D7iOPLOuyoF/tcx1zfzHA8yxEW9tT+9Bmw88
8SMbsm1rbmf10rt8bxdWv29lOhLrqHlJBLkqO7Nn9tiW84MKMFjzAdV1X4cwbMfg
shyxsoQsg3EoY1oyPWbFMxn5TKbGiKntBAqSMvMtaTmEVaW+XeiO8/0AEQEAAYkC
JQQYAQIADwUCaJD/7QIbDAUJBcSQAAAKCRA/rdi0UKzD7uzND/9wYsHyEHqngBf/
Q7vc4sSSBTjJOd/jrQ0l7c7w0BRUPwnQOIfHEl5fyQ3sRBebuZKDM7ybV6/EfyDc
RtdyiCTeslzdo1bzqtJnaH16c4uATjNjR8fpNE060MdvFaZBnPAW5OoJHnbE0nm1
FVxq4Ok9X77sgyBdONEHt5RYnRjEqxL1FssIWvrh/MlC3I27Xa30iOzy73pBTw0K
9nPOXTnIPLUxNuwc2Fs8vknJaMl0zWVHsKJWI/sZOyFmInVzSHZDACW9frqJDrsV
KBBjgGKvSnmBbsHfzYSTqnqc8v/nMMlST0AeLPC1gjJKjzGITgeYJdvTeurmSdqw
WeQYRm94CfkYlSKJBexSOZg+ecX1LgKglw/jqLR6STuTchan2mJexWIyUxszGoYI
08g54jOuF90dMXyj6hjtPUvr/jCoRakl4BNTPiOUzGvRy3xhQx7XShbQqzHC5hyv
ygPNGhAjAOFlGV/6FjFpRfC9TWfcOlqCSyhcGMz4QhKoXDO2WvoW5/hYBWf4bIPg
y0VY6rEAyULMDMnG3mJb8enueqf7uqDv1B29JlmhBBVUzkqQJUfXdIBCVBslgdvA
w5tC1dgrtiLBxa/2Rok0meY6gd6oX8AcuWFGbo/FIx5McGQd/ntIGHbaOr+wjLqJ
9Lib8m3COhQWm7U5HXP9fpQKlTo2fg==
=Hs4B
-----END PGP PUBLIC KEY BLOCK-----

Recent vulnerabilities¶

Denial of service and missing authorization in door servers
Bug 18492 (ipmgmtd) CVE-2026-104117
Bug 18493 (zonestatd) CVE-2026-104116
Bug 18494 (nscd) CVE-2026-104112
Bug 18495 (nwamd) CVE-2026-104114
Bug 18496 (reparsed) CVE-2026-104115
Guest can panic host using REP instructions Bug 18491 CVE-2026-102916
SCTP frees wrong-size, and needs to keep private options private Bug 18118,
CVE-2023-31284 ddi_parse needs len Bug 15586
CVE-2019-9579 Access problem with SMB server Bug 10506
dls_unbind() needs better checking Bug 10543

Advisory information¶

How to update your system¶

Updating is distribution-dependent. Please consult your distribution's documentation for how best to update.