CVE-2026-90995

A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the pam_app_services configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.

This Moderate impact denial of service vulnerability in SSSD's PAM responder requires local access and a non-default pam_app_services configuration. An authenticated local attacker can send a crafted PAM request, leading to a NULL pointer dereference and crashing the PAM responder, thereby disrupting authentication services. The default SSSD configuration is not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring pam_app_services in the [pam] section of /etc/sssd/sssd.conf if it is not operationally required. If pam_app_services is configured, remove or comment out the pam_app_services line and restart the sssd service.

Example:

# /etc/sssd/sssd.conf
[pam]
# pam_app_services = app_svc

After modifying the configuration, restart the SSSD service: systemctl restart sssd

Note that restarting the SSSD service may temporarily interrupt authentication and authorization services.