This vulnerability involves an out-of-bounds read in the extract_authtok_v1() function of the SSSD PAM responder in Red Hat Enterprise Linux 10. The function does not validate the auth_token_length field against the remaining buffer size before processing a protocol v1 request. A local attacker who can connect to the SSSD PAM responder unix socket can exploit this flaw by sending a crafted protocol v1 request, causing a process crash and denial of service. The default PAM client uses protocol v3 and is not affected. On SSSD 2.10 and later, responders run as unprivileged users; earlier versions may run as root. The vulnerability can cause repeated crashes leading to persistent authentication outages. No mitigation or patch currently meets Red Hat's criteria for deployment. This issue is distinct from CVE-2026-6245, which affects a different code path.

The vulnerability allows a local attacker with access to the SSSD PAM responder socket to cause an out-of-bounds read, leading to a process crash and denial of service of SSSD-mediated authentication. This can result in persistent authentication outages if the responder repeatedly crashes. There is no impact on confidentiality or integrity, but availability is significantly affected. The default PAM client is not vulnerable as it uses protocol v3. The vulnerability affects SSSD versions prior to 2.10 where the responder may run as root, and later versions where it runs as an unprivileged user.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. The vulnerability can only be triggered by a local attacker with access to the PAM responder socket using protocol v1 requests, which are not used by the default PAM client. Users should monitor Red Hat's advisory page for updates on fixes or mitigations. Until a fix is released, limiting local access to the PAM responder socket may reduce risk.