CVE-2026-88252

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.

Red Hat has classified this vulnerability as Moderate severity because exploitation requires local access and solely impacts service availability rather than compromising system confidentiality or integrity. In standard Red Hat Enterprise Linux deployments, SSSD responder UNIX domain sockets are accessible to local users to facilitate identity resolution and authentication. To trigger this denial of service, an attacker must deliberately flood and maintain concurrent connections to deplete system file descriptors, confining the operational impact to the targeted responder.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.