A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request… (CVE-2026-104042)

CVE-2026-104042 is a vulnerability in sssd where a local attacker can trigger a Denial of Service by sending a specially crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. The lack of input validation causes the service to read beyond buffer boundaries, crashing the PAM responder. This vulnerability affects numerous specific sssd versions as listed. The CVSS 3.1 base score is 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability allows a local attacker to cause a Denial of Service by crashing the PAM responder component of sssd, potentially disrupting authentication services on affected systems. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict local access to trusted users only to mitigate risk of exploitation.