CVE-2026-104034

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate because exploitation requires local authenticated access and relies on an optional, non-default Kerberos Credential Manager (KCM) renewal feature configured with the secdb storage backend. Under standard Red Hat Enterprise Linux deployments, automated ticket renewal within KCM is disabled by default. Successful exploitation is limited to terminating or destabilizing the KCM responder service, resulting in a localized denial of service without exposing sensitive credential data or allowing privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

KCM ticket renewal, the affected feature, is disabled by default (tgt_renewal defaults to false). On systems where it has been enabled, it can be disabled to avoid the vulnerable code path:

1. Edit /etc/sssd/sssd.conf and set tgt_renewal = false in the [kcm] section.
2. Restart the SSSD KCM responder to apply the change:

systemctl restart sssd-kcm.service

Note: disabling TGT renewal means renewable Kerberos tickets stored in the KCM credential cache are no longer renewed automatically and must be re-acquired (for example, with kinit) before they expire. Restarting sssd-kcm.service briefly interrupts in-flight KCM requests.