CVE-2026-104039

A flaw was found in SSSD due to a missing state validation check in passkey Kerberos handling. A local attacker can send a specially crafted PAM request when passkey authentication is enabled, causing the PAM responder to dereference an uninitialized pointer and crash.

A flaw was found in SSSD where a local attacker with access to the NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This causes an out-of-bounds memory read during packet parsing, crashing the responder process.

A flaw was found in SSSD due to missing input validation in the PAM responder. A local attacker can send a crafted PAM request containing a zero-length authentication token, causing the service to read beyond buffer boundaries and crash the PAM responder.

A flaw was found in SSSD's NSS responder negative cache. An unprivileged local user can repeatedly request lookups for nonexistent entries, causing the cache to grow without bound because it does not limit the total number of stored entries.

A flaw was found in SSSD when configured with the Entra ID identity provider, where lookup names containing single quotes are not properly escaped before being included in Microsoft Graph OData queries. A low-privileged local user can alter query filters to broaden user or group searches.

A flaw was found in SSSD where, in LDAP environments configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method can bypass access control restrictions.

A flaw was found in SSSD where the service fails to verify the presence of the SID extension before processing it in deployments configured with SID-based certificate mapping rules. A remote attacker can submit a certificate lacking the expected SID extension, causing the process to crash during authentication or lookup operations.

A flaw was found in SSSD where a local attacker can send a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process.

The NFS idmap plugin in SSSD fails to abort after detecting that a cached entry exceeds the destination buffer size, leading to an out-of-bounds write. A local attacker can trigger this by requesting identity lookups that resolve to oversized cached entries, causing a crash of the identity mapping service (DoS) and potential corruption of adjacent process memory.

In the Kerberos Credential Manager (KCM) responder in SSSD, the service fails to release cached objects from memory when credentials are removed. A local user can maintain a persistent connection and repeatedly store and destroy credentials, causing continuous memory growth and ultimately exhausting available memory, rendering the service unresponsive (DoS).