A use-after-free vulnerability exists in the System Security Services Daemon (SSSD) PAM responder component on Red Hat Enterprise Linux 10 when authenticating with a YubiKey. The flaw is triggered by improper handling of a memory pointer, leading to a crash of the SSSD service. A local attacker with high privileges could exploit this by manipulating smartcard or YubiKey contents, causing denial of service and potentially privilege escalation, though exploitation is challenging. No official remediation level or patch information is provided in the advisory, and no known exploits are reported in the wild.

Successful exploitation results in denial of service by crashing the SSSD PAM responder, disrupting authentication processes on affected systems. There is also a potential for privilege escalation, but this is noted as difficult to achieve. The vulnerability requires local access with high privileges and does not involve user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12610 for current remediation guidance. Until a patch or official fix is available, restrict local access to trusted users and monitor for unusual authentication failures related to smartcard or YubiKey usage. No vendor advisory states that no action is required or that the issue is already mitigated.