CVE-2026-104039
Received Received - Intake

SSSD GSSAPI Authentication DoS Vulnerability

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: redhat-SADP

Description
A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-104039
EUVD
EUVD-2026-92909

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat sssd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-825 The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service (DoS) vulnerability in SSSD where a local attacker can crash the PAM responder by exploiting a flaw in GSSAPI authentication handling. When a GSSAPI context completes, cached connection state is freed without clearing a reference pointer. If an attacker sends another request over the same connection, the service crashes due to invalid memory access.

Detection Guidance

Detecting this vulnerability requires checking if SSSD's PAM responder is running with GSSAPI authentication enabled. Inspect SSSD logs for crashes in the PAM responder process. Commands like 'sssd --genconf' or 'systemctl status sssd' may show service status. Check for active GSSAPI sessions with 'ss -tulnp | grep sssd' or 'journalctl -u sssd-pam' for errors.

Impact Analysis

The vulnerability allows a local authenticated user to disrupt system authentication services by crashing the PAM responder process. This causes temporary loss of authentication functionality until the service is manually restarted. It requires local access, specific non-default configuration, and an established session.

Compliance Impact

This vulnerability primarily impacts availability by causing authentication service disruptions. While it does not directly compromise confidentiality or integrity, repeated DoS conditions could violate availability requirements in GDPR or HIPAA compliance frameworks that mandate reliable access to critical systems.

Mitigation Strategies

Disable PAM GSSAPI for affected services by editing SSSD config files (e.g., /etc/sssd/sssd.conf) and setting 'pam_gssapi_services' to an empty list. Restart SSSD with 'systemctl restart sssd'. Alternatively, upgrade SSSD to a patched version if available. Monitor the PAM responder for crashes and restart it if needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104039. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart