Denial of Service Vulnerability in SSSD Affecting Red Hat

CVE-2026-104039

What is CVE-2026-104039?

A vulnerability exists in the System Security Services Daemon (SSSD) where a local user can disrupt authentication services, leading to a denial of service. This issue arises from the improper management of memory during the handling of GSSAPI authentication in the PAM responder. Specifically, upon completion, the cached connection state is freed without properly clearing the reference pointer. An attacker can exploit this flaw by sending additional requests over the same connection, resulting in the service accessing invalid memory, which can cause it to terminate unexpectedly.

References