Security update for sssd

CVE-2026-12610 is a use-after-free vulnerability in the SSSD PAM responder component that occurs during authentication with a YubiKey or smartcard. The vulnerability arises from incorrect handling of a memory pointer, which can lead to a crash of the sssd_pam process. A local attacker with control over smartcard or YubiKey contents could trigger this flaw to cause a denial of service by crashing the authentication process. There is also a potential for privilege escalation, but exploitation is difficult due to the need for physical proximity and control over authentication tokens during an active session. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity) with high impact on confidentiality, integrity, and availability, but requires high privileges and local access to exploit. Multiple versions of sssd are affected, and official patches have been released by vendors such as Red Hat and Ubuntu.

The primary impact is denial of service caused by the crash of the SSSD PAM responder during YubiKey or smartcard authentication, which disrupts user access. There is a theoretical risk of privilege escalation, but exploitation is difficult and requires specific conditions including local access and control over authentication tokens. The vulnerability affects confidentiality, integrity, and availability with high impact metrics, but the attack complexity and required privileges reduce the likelihood of exploitation.

Official patches are available and should be applied to affected sssd versions as provided by vendors such as Red Hat and Ubuntu. Additionally, configuring the sssd systemd service to automatically restart on failure can help maintain authentication availability if a denial-of-service crash occurs. After applying updates, a restart of the sssd service is required to activate the fixes.