CVE-2026-68743: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in the SSSD PAM responder's extract_authtok_v1() function, which fails to validate the auth_token_length field against the remaining buffer size before processing. This allows a local attacker who can connect to the PAM responder unix socket and send crafted protocol v1 requests to trigger an out-of-bounds read, leading to a process crash and denial of service. The issue only affects protocol v1 requests; the default PAM client uses protocol v3 and is not affected. On SSSD 2.10 and later, responders run as unprivileged users, reducing risk, but denial of service of SSSD-mediated authentication remains possible. The vulnerability is distinct from CVE-2026-6245 and is tracked under CWE-125 (Out-of-bounds Read).

A local attacker with access to the SSSD PAM responder socket can cause an out-of-bounds read resulting in a process crash and denial of service of authentication services mediated by SSSD. Repeated crashes may cause persistent authentication outages. There is no impact on confidentiality or integrity, but availability is affected. The vulnerability does not allow remote exploitation or privilege escalation. The CVSS v3.1 score is 5.5 (medium severity) reflecting local attack vector, low complexity, and no user interaction required.

Currently, no mitigation or official fix meeting Red Hat's criteria for ease of use, deployment, or stability is available. The vulnerability requires local access to the PAM responder socket and crafted protocol v1 requests, which are not used by the default PAM client. Users should monitor Red Hat advisories for future patches or updates. Customers with Red Hat Technical Account Managers can consult them for tailored guidance. Upgrading to versions where this issue is addressed, if and when available, is recommended.