CVE-2026-104035

In SSSD (System Security Services Daemon), a flaw exists where pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption, potentially leading to DoS.

In SSSD, a race condition in the autofs responder between asynchronous enumeration completion and map invalidation can be exploited by a local user to cause memory leaks, leading to excessive memory consumption that can disrupt or crash the autofs service.

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.

A flaw was found in SSSD due to a missing state validation check in passkey Kerberos handling. A local attacker can send a specially crafted PAM request when passkey authentication is enabled, causing the PAM responder to dereference an uninitialized pointer and crash.

A flaw was found in SSSD where a local attacker with access to the NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This causes an out-of-bounds memory read during packet parsing, crashing the responder process.

A flaw was found in SSSD due to missing input validation in the PAM responder. A local attacker can send a crafted PAM request containing a zero-length authentication token, causing the service to read beyond buffer boundaries and crash the PAM responder.

A flaw was found in SSSD's NSS responder negative cache. An unprivileged local user can repeatedly request lookups for nonexistent entries, causing the cache to grow without bound because it does not limit the total number of stored entries.

A flaw was found in SSSD when configured with the Entra ID identity provider, where lookup names containing single quotes are not properly escaped before being included in Microsoft Graph OData queries. A low-privileged local user can alter query filters to broaden user or group searches.

A flaw was found in SSSD's GSSAPI authentication handling in the PAM responder, where cached connection state is freed without clearing the reference pointer. A local user can send an additional request over the same connection, causing the service to access invalid memory and terminate unexpectedly.