CVE-2026-104046

A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.

This vulnerability is rated as having Moderate impact because it requires local access to a PAM authentication interface and specifically targets non-default configurations where identity provider (IdP) authentication is active. An unprivileged local attacker can repeatedly trigger device pre-authentication flows without completing the final authentication step, causing SSSD to retain orphaned state in memory indefinitely. While prolonged exploitation can lead to a denial of service via memory exhaustion of the SSSD backend process, the flaw does not facilitate unauthorized access, data exposure, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.