CVE-2026-80048

A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.

This moderate impact local denial of service in sssd-kcm is due to excessive memory preallocation. Exploitation requires a local attacker to connect to the sssd-kcm UNIX socket, which is only possible if the sssd-kcm responder is enabled and permits local client connections. When successfully exploited the sssd-kcm process stops replying to any request, meaning any user depending on services like KRB5, GSSAPI, SASL, etc will be unable to authenticate to local or remote services, representing a full DoS of the system's Kerberos Cache Manager.

This vulnerability affects only systems with the sssd-kcm installed and configured, which is not enabled by default on sssd installations for Red Hat Enterprise Linux.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.