CVE-2026-90994

A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.

A moderate out-of-bounds read vulnerability was found in the sssd PAM responder's protocol v1 parser, pam_parse_in_data(), affecting Red Hat Enterprise Linux, Red Hat In-Vehicle OS, OpenShift Container Platform, and Fedora releases that ship sssd. A local attacker who can connect to the PAM responder UNIX socket can negotiate protocol v1 via SSS_GET_VERSION and send an SSS_PAM_AUTHENTICATE request with an empty or truncated body. Because the parser computes last = blen - 1 before validating blen and dereferences body[end++] without first confirming end < blen, an empty body underflows last to SIZE_MAX and truncated string fields read past the end of the message buffer. The resulting out-of-bounds read can cause the PAM responder to terminate or restart, resulting in a local denial of service. The available evidence does not establish information disclosure, data modification, privilege escalation, or code execution. Red Hat assessed this flaw as Moderate impact with a CVSS:3.1 score of 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), consistent with the CVE.org rating. For most affected Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift streams the fix is deferred, because Moderate-severity flaws with a CVSS score below 7.0 that affect only availability are not prioritized for tracked fixes; the residual risk is a local denial of service from clients that can already access the PAM responder socket. The Fedora sssd package is delegated to the Fedora community, where a fix is being pursued. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope and will not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There's no available mitigation for this issue.