CVE-2026-104031

A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).

Red Hat rates this vulnerability as Moderate severity because exploitation requires local access to an active SSSD autofs responder socket, and the impact is confined to memory exhaustion without compromising system confidentiality or integrity. On standard Red Hat Enterprise Linux systems, the autofs responder is not enabled by default and is only active when automount integration is explicitly configured. An attacker must maintain an open connection and repeatedly issue valid queries to consume resources, limiting the blast radius to the availability of the responder service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the SSSD autofs responder if automount maps are not served through SSSD in your environment. To stop and disable the socket-activated autofs responder, run:

systemctl stop sssd-autofs.socket sssd-autofs.service

systemctl mask sssd-autofs.socket

If the autofs responder is explicitly configured in /etc/sssd/sssd.conf, remove autofs from the services line and restart SSSD. If the responder must remain enabled, restrict access to the autofs responder socket to trusted local clients only. Closing long-lived client connections or restarting the responder reclaims the retained memory, but this is operational containment rather than a complete fix. Note that disabling the autofs responder prevents the resolution and mounting of automount maps managed via SSSD, and stopping or restarting SSSD services will briefly interrupt active identity lookups and automount operations.