CVE-2026-104036: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in the SSSD NFS idmap plugin where, upon retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but does not abort before copying data. This results in an out-of-bounds write when identity lookups resolve to oversized cached entries. The flaw allows a local attacker with low privileges to cause a denial of service by crashing the identity mapping service and may also lead to memory corruption adjacent to the buffer.

The primary impact is denial of service (DoS) caused by crashing the identity mapping service. There is also a potential for adjacent process memory corruption, which could lead to undefined behavior or further security issues. Confidentiality and integrity impacts are rated low, while availability impact is high according to the CVSS vector.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104036 for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, limiting local access to trusted users may reduce risk.