CVE-2026-104029: SSSD Autofs Responder DoS Vulnerability

CVE-2026-104029 Overview

CVE-2026-104029 is an out-of-bounds read vulnerability in the System Security Services Daemon (SSSD) autofs responder. A local attacker can send a specially crafted request to the autofs responder UNIX socket. Improper buffer offset calculation during request parsing causes the service to read memory outside the intended bounds. The result is a crash of the autofs responder process, producing a denial of service (DoS) condition. The flaw is tracked under [CWE-125: Out-of-bounds Read] and requires local, authenticated access with low privileges.

Critical Impact
A local user with low privileges can crash the SSSD autofs responder, disrupting automount name-service lookups until the service recovers.

Affected Products

System Security Services Daemon (SSSD) — autofs responder component
Linux distributions shipping affected SSSD builds (see Red Hat CVE-2026-104029 Advisory)
Environments relying on SSSD for autofs map resolution

Discovery Timeline

2026-10-05 - CVE-2026-104029 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104029

Vulnerability Analysis

The SSSD autofs responder exposes a UNIX domain socket that clients use to request automount map information. During parsing of inbound requests, the responder calculates an offset into its receive buffer. The calculation is incorrect under specific input conditions. The parser then reads bytes beyond the valid buffer region. This out-of-bounds read triggers a process crash and terminates the responder.

Automount lookups served through SSSD fail while the responder is down. Users attempting to access network home directories or map-managed mounts experience service interruption. The impact is bounded to availability of the autofs responder. Confidentiality and integrity are not affected per the published CVSS vector.

Root Cause

The root cause is an improper buffer offset calculation in the autofs request parsing path. The code trusts a size or offset value derived from the request without validating it against the actual buffer length. When the computed offset exceeds the allocated buffer, the subsequent memory read falls outside valid heap or stack memory. The kernel delivers a fault that terminates the responder process. The condition is classified as [CWE-125].

Attack Vector

Exploitation requires local access and the ability to connect to the autofs responder UNIX socket. Any local user with permission to open the socket can send a crafted payload. No elevated privileges, user interaction, or network access are required. The attacker cannot read memory contents or execute code through this flaw. The outcome is limited to crashing the responder and denying automount services to other users on the host.

No verified exploit code is publicly available at the time of writing. See the Red Hat Bug Report #2479444 for additional technical context.

Detection Methods for CVE-2026-104029

Indicators of Compromise

Unexpected termination or repeated restarts of the sssd_autofs responder process
Core dump files generated for sssd_autofs under /var/lib/systemd/coredump/ or the configured coredump path
Autofs lookup failures in /var/log/sssd/sssd_autofs.log correlated with crash entries in journalctl -u sssd

Detection Strategies

Monitor systemd service state transitions for the SSSD autofs responder and alert on unexpected exit codes or restart loops
Correlate local user activity against process crash events for sssd_autofs to identify a potential local attacker
Audit UNIX socket connections to the autofs responder path using Linux audit rules on /var/lib/sss/pipes/autofs

Monitoring Recommendations

Enable systemd coredump collection and forward core events to a centralized log pipeline for review
Track SSSD service health metrics through host monitoring and alert on recurring restart counters
Review audit logs for processes connecting to the autofs responder socket outside of expected automount client activity

How to Mitigate CVE-2026-104029

Immediate Actions Required

Apply vendor-provided SSSD updates as they become available from your Linux distribution
Restrict shell access on hosts running SSSD with the autofs responder enabled to trusted users only
Monitor the SSSD autofs responder service for crashes and configure automatic restart with rate limiting

Patch Information

Refer to the Red Hat CVE-2026-104029 Advisory for patched package versions and errata. Downstream distributions tracking SSSD should publish corresponding updates. Apply the vendor patch through your standard package manager once available.

Workarounds

Disable the autofs responder in sssd.conf by removing autofs from the services list if automount integration is not required
Limit local user accounts on affected hosts and enforce least-privilege access controls
Configure systemd to restart sssd automatically after a crash to minimize service downtime

bash

# Disable the autofs responder in /etc/sssd/sssd.conf
# Edit the [sssd] section and remove 'autofs' from services
[sssd]
services = nss, pam

# Restart SSSD to apply the change
sudo systemctl restart sssd