This vulnerability exists in the sssd component of Red Hat Enterprise Linux 10, specifically in the PAM responder's protocol v1 parser function pam_parse_in_data(). A local attacker with access to the PAM responder's UNIX socket can negotiate protocol v1 and send an empty or truncated PAM request body, causing an out-of-bounds read. This memory access flaw can lead to the PAM responder terminating or restarting, causing a denial of service. The vulnerability does not affect confidentiality or integrity but impacts availability. The issue is tracked as CVE-2026-90994 and has a CVSS 3.1 base score of 4.0 (medium).

The vulnerability allows a local attacker with access to the PAM responder UNIX socket to cause an out-of-bounds read, which can crash or restart the PAM responder process. This results in a local denial of service condition. There are no reported impacts on confidentiality or integrity. The attack requires local access and low complexity, with no privileges required beyond socket access.

Red Hat recommends restricting local access to the PAM responder UNIX socket, typically located at /var/lib/sss/pipes/pam, to trusted users and processes only. This can be enforced by adjusting file system permissions on the socket file. No official patch or fix status is provided in the advisory; therefore, patch status is not yet confirmed—check the Red Hat advisory for updates.