CVE-2026-104037

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).

This vulnerability is rated as Moderate because exploitation is limited to a local denial of service against the SSSD autofs responder daemon, without enabling privilege escalation or data confidentiality/integrity loss. The autofs responder is only exposed if enabled in the SSSD configuration and accessible through its local UNIX socket. Systems where SSSD does not manage automount maps or where the autofs responder is inactive are unaffected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If SSSD automount map integration is not required, disable the autofs responder. Stop and mask the socket-activated service:

systemctl stop sssd-autofs.socket sssd-autofs.service

systemctl mask sssd-autofs.socket

If 'autofs' is explicitly listed in the services directive under the [sssd] section of /etc/sssd/sssd.conf, remove it and restart the SSSD service:

systemctl restart sssd

If autofs support is required, restrict access to the autofs responder UNIX socket (typically /var/lib/sss/pipes/autofs) to trusted local users. Note that disabling the autofs responder prevents SSSD from resolving automount maps, and restarting SSSD may temporarily disrupt identity lookups and active automount operations.