CVE-2026-104031: Missing Release of Resource after Effective Lifetime in Red Hat Red Hat Enterprise Linux 10

This vulnerability in SSSD affects Red Hat Enterprise Linux 10 configurations with the autofs responder service enabled. The flaw causes memory allocated during successful request processing to remain unreleased until the client connection terminates. A local attacker with the ability to maintain an open connection can repeatedly submit valid requests, leading to memory exhaustion and a denial of service condition. The CVSS 3.1 base score is 5.5, reflecting a local attack vector with low complexity and no user interaction required, but resulting in availability impact only.

The impact is a denial of service (DoS) caused by memory exhaustion on the affected system. There is no confidentiality or integrity impact reported. The attacker must have local access and the ability to maintain an open connection to exploit this vulnerability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104031 for current remediation guidance. Until a patch is available, consider disabling the autofs responder service if feasible to mitigate the risk. Monitor for unusual resource consumption related to SSSD connections.