CVE-2026-12610

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

This Moderate impact use-after-free flaw in the SSSD PAM responder can lead to a denial of service during YubiKey authentication, causing the process to crash and disrupt user access. While there is a theoretical potential for privilege escalation, exploitation is considered difficult due to the specific conditions required, which involve an attacker controlling smartcard contents during an active authentication attempt.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure the sssd systemd service to automatically restart on failure. This ensures authentication remains available even if an attacker triggers the denial-of-service crash.