CVE-2026-80048
Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion DoS in sssd-kcm Responder

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: redhat-SADP

Description
A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-19
AI Q&A
2026-10-07
EPSS Evaluated
2026-10-18
NVD
CVE-2026-80048
EUVD
EUVD-2026-94103

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat sssd 2.12.0-1.el10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a local Denial of Service (DoS) vulnerability in the sssd-kcm component of Red Hat Enterprise Linux. An attacker with local access to the sssd-kcm UNIX socket can send a large request length header and stall the connection. This causes the system to preallocate excessive memory, leading to memory exhaustion and a DoS for affected deployments.

Detection Guidance

Check if sssd-kcm is installed and running using systemctl status sssd-kcm. Monitor for high memory usage in sssd-kcm processes. Inspect logs for failed authentication attempts or unresponsive services.

Impact Analysis

If exploited, this vulnerability can cause the sssd-kcm process to stop responding, preventing users from authenticating to local or remote services that rely on KRB5, GSSAPI, SASL, and similar protocols. This effectively disables the system's Kerberos Cache Manager, impacting authentication and access to services.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by exhausting memory in the sssd-kcm component, which disrupts authentication services like Kerberos. While it does not directly expose data, prolonged DoS conditions could impact system availability, potentially violating compliance requirements for service uptime in standards like HIPAA or GDPR.

Mitigation Strategies
  • Disable the sssd-kcm service if not required: systemctl disable --now sssd-kcm.
  • Restrict access to the sssd-kcm UNIX socket by modifying file permissions or using SELinux policies.
  • Reduce idle timeout and file descriptor limits for the sssd-kcm service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart