CVE-2026-104035

A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.

This vulnerability is rated as Moderate impact because exploitation is confined to a local denial-of-service condition affecting the SSSD Kerberos Credential Manager (KCM) responder without impacting data confidentiality, integrity, or elevating privileges. A local, authenticated user with access to the KCM UNIX socket can trigger unbounded memory accumulation within the responder daemon by maintaining a persistent connection while cycling credential operations. The blast radius is limited to the availability of the KCM responder process, and standard system operations or other SSSD services remain functional.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue can only be exploited when the SSSD KCM responder is enabled and reachable by a local user, so mitigation focuses on limiting that exposure. On systems that do not require KCM credential caching, disable the KCM responder by stopping and masking the sssd-kcm socket and service:

systemctl stop sssd-kcm.socket sssd-kcm.service

systemctl mask sssd-kcm.socket sssd-kcm.service

Before disabling KCM, ensure an alternative Kerberos credential cache type (for example FILE: or KEYRING:) is configured in /etc/krb5.conf, because clients or system configurations that default to KCM: credential caches would otherwise lose Kerberos ticket management. On systems where KCM is required, restrict access to the KCM UNIX socket (/var/run/.heim_org.h5l.kcm-socket) to trusted local users where deployment policy permits. If abnormal memory growth is observed, closing the abusive client connection or restarting the sssd-kcm responder reclaims the retained connection-scoped memory; these are operational workarounds rather than a fix, and no released package fix is currently established.