CVE-2026-104039

A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate.

This vulnerability is rated as Moderate because exploitation requires local access, specific non-default configuration, and an established session, resulting solely in a denial of service. The flaw is only reachable when SSSD's PAM responder has GSSAPI authentication explicitly configured and enabled for specific services. Furthermore, triggering the condition requires an authenticated local user to complete an initial GSSAPI context handshake and subsequently submit an additional request over the same connection. Because exploitation crashes the PAM responder process without compromising system confidentiality or integrity, the overall risk is reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A workaround is available for this issue. PAM GSSAPI authentication can be disabled in the SSSD configuration: edit /etc/sssd/sssd.conf, and in the [pam] section remove or comment out the pam_gssapi_services option (or set it to an empty value), so that no service is permitted to use GSSAPI authentication through the PAM responder. Then restart the SSSD service (systemctl restart sssd) to apply the change. Note that disabling PAM GSSAPI authentication prevents clients from authenticating to the affected PAM services using Kerberos tickets, requiring them to use alternative authentication methods such as passwords. Restarting the SSSD service also briefly disrupts ongoing authentication requests. Restarting the PAM responder can restore service after a crash, but it does not remove the underlying flaw.