CVE-2026-104036

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to oversized cached entries, resulting in an out-of-bounds write. This flaw primarily leads to a Denial of Service (DoS) by crashing the identity mapping service, and may also corrupt adjacent process memory.

This vulnerability is rated as Moderate because successful exploitation requires specific deployment prerequisites, notably rpc.idmapd actively utilizing the SSSD NFS plugin with memcached lookups enabled. Under these conditions, an authenticated local user capable of triggering UID or GID resolution for oversized account names may corrupt adjacent memory within the idmap daemon process. The blast radius is primarily confined to service destabilization or a local denial of service, with no reliable privilege escalation or remote execution demonstrated in typical default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the vulnerable memcache lookup path of the SSSD NFS idmap plugin: in the rpc.idmapd configuration, set memcache = false for the SSSD plugin (or switch the translation Method away from sss), and restart the rpc.idmapd service to apply the change. This makes uid/gid name lookups bypass the vulnerable get_user_from_mc() and get_group_from_mc() code paths. Note that with memcache disabled, lookups are served through the SSSD responder instead of the in-memory cache, which may add lookup latency on systems with heavy NFS identity resolution traffic. No released package fix is currently established for this issue, so this configuration change is the recommended interim workaround until a fixed build is available.