CVE-2026-104041

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates.

This vulnerability is rated as Moderate impact because exploitation is confined to authenticated local accounts capable of issuing repeated failed lookups, restricting the blast radius strictly to host service availability rather than privilege escalation or data disclosure. On Red Hat Enterprise Linux systems where SSSD handles local identity resolution, the responder socket is accessible to unprivileged users by default. While sustained, distinct lookup misses can exhaust responder memory and disrupt host name service availability, the issue cannot be triggered remotely in standard configurations and does not compromise system integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Set entry_negative_timeout = 0 in the [nss] section of /etc/sssd/sssd.conf to disable non-permanent negative-cache insertions, then restart the SSSD service (for example, systemctl restart sssd) to apply the change. Note that restarting sssd briefly interrupts active authentication and identity lookups, and disabling the negative cache increases lookup traffic to identity backends for nonexistent entries. If responder memory growth is observed, the accumulated negative-cache state can be cleared through the existing operational clear path or by restarting the responder. Restricting untrusted local users also limits exposure on systems where the NSS responder socket is reachable by local users.