CVE-2026-90995

Received Received - Intake

SSSD PAM Responder NULL Pointer Dereference DoS

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: redhat-SADP

Description

A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-09-15

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90995

EUVD

EUVD-2026-77589

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	sssd	*
red_hat	sssd	2.12.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in SSSD (System Security Services Daemon) affecting its PAM responder. A local attacker with access to the PAM responder socket can send a specially crafted request that omits the service item. If the pam_app_services configuration is enabled, this triggers a NULL pointer dereference, causing the PAM responder to crash and disrupt authentication services.

Detection Guidance

To detect this vulnerability, check if the pam_app_services configuration is enabled in /etc/sssd/sssd.conf. Run: grep -r 'pam_app_services' /etc/sssd/. If the line exists and is not commented out, the system may be vulnerable. Also verify SSSD version with: rpm -q sssd. Affected versions include sssd-2.12.0-1.el10.

Impact Analysis

The vulnerability allows a local attacker to crash the PAM responder, blocking authentication requests until the service is manually restarted. This can disrupt user logins and system access. The impact is limited to availability, with no effect on confidentiality or integrity of data.

Compliance Impact

This vulnerability causes a denial of service by crashing the PAM responder, disrupting authentication services. This could impact compliance with GDPR or HIPAA by potentially preventing authorized users from accessing systems, leading to unauthorized access risks or service disruptions. However, the vulnerability requires local access and a non-default configuration, limiting its real-world impact.

Mitigation Strategies

Remove or comment out the pam_app_services line in /etc/sssd/sssd.conf if present. Then restart the sssd service with: systemctl restart sssd. This may temporarily interrupt authentication services. Avoid configuring pam_app_services unless absolutely necessary.

Hi! I’m here to help you understand CVE-2026-90995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70