CVE-2026-104042: SSSD PAM Denial of Service Vulnerability

CVE-2026-104042 Overview

CVE-2026-104042 is an out-of-bounds read vulnerability in the System Security Services Daemon (SSSD) Pluggable Authentication Module (PAM) responder. A local attacker can crash the PAM responder by sending a crafted PAM request containing a zero-length authentication token to the responder socket. The service fails to validate the token length and reads beyond buffer boundaries while processing the request. The resulting crash disrupts authentication services on the host, affecting any application that depends on SSSD for user authentication.

Critical Impact
Local attackers can trigger a denial-of-service condition that disables SSSD-backed authentication, blocking legitimate logins and identity lookups until the service recovers.

Affected Products

SSSD (System Security Services Daemon) PAM responder
Red Hat Enterprise Linux distributions shipping affected SSSD builds
Downstream Linux distributions packaging the vulnerable SSSD version

Discovery Timeline

2026-10-06 - CVE-2026-104042 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104042

Vulnerability Analysis

The flaw resides in the SSSD PAM responder, which processes authentication requests from PAM-enabled applications over a local UNIX domain socket. When a client submits a PAM message containing an authentication token field, the responder parses the token length and copies the bytes into an internal buffer. The responder does not reject tokens with a declared length of zero and proceeds to dereference memory beyond the intended buffer boundaries. This behavior maps to [CWE-125] Out-of-Bounds Read and results in a process crash rather than information disclosure in observed cases. Because SSSD is central to authentication on many enterprise Linux hosts, a crash of the PAM responder blocks interactive logins, SSH authentication, and sudo evaluations that depend on SSSD-provided identities.

Root Cause

The root cause is missing input validation on the length of the PAM authentication token. The responder trusts the length value supplied by the client and does not enforce a minimum size before performing buffer operations. When the length is zero, downstream parsing routines read past the end of the allocated structure. The defect is confined to local attack surface because the PAM responder socket is only reachable from the local system.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker with a shell account on the target host opens the SSSD PAM responder socket and submits a crafted PAM request where the authentication token length is set to zero. The responder processes the malformed request, performs the out-of-bounds read, and crashes. Repeated requests prevent the service from stabilizing. The vulnerability does not expose confidential data or allow code execution; the impact is restricted to availability of authentication services.

// No verified proof-of-concept code is available.
// Refer to the Red Hat advisory and Bugzilla report for technical details.

Detection Methods for CVE-2026-104042

Indicators of Compromise

Unexpected sssd_pam process termination events in systemd journal entries or /var/log/sssd/sssd_pam.log.
Core dumps attributed to the sssd_pam binary following local user activity.
Authentication failures across PAM-dependent services (SSH, sudo, login) that correlate in time with PAM responder restarts.

Detection Strategies

Monitor systemd for repeated restarts of the sssd-pam.service unit, which indicate crash-restart loops.
Alert on SIGSEGV or SIGABRT signals delivered to processes named sssd_pam using audit rules or eBPF-based telemetry.
Correlate PAM responder crashes with local user sessions to identify the originating account.

Monitoring Recommendations

Ingest SSSD logs and systemd journal data into a centralized logging platform for crash pattern analysis.
Track authentication latency and failure rates on hosts running SSSD to surface service degradation early.
Enable Linux audit rules on connections to the SSSD PAM responder socket under /var/lib/sss/pipes/.

How to Mitigate CVE-2026-104042

Immediate Actions Required

Apply the SSSD security update from your Linux distribution as soon as it becomes available.
Restrict shell access on multi-user systems to trusted accounts to reduce local attack surface.
Configure systemd service recovery for sssd-pam.service to minimize downtime after a crash.

Patch Information

Refer to the Red Hat CVE-2026-104042 Advisory and the Red Hat Bug Report #2478862 for package versions and errata. Downstream distributions typically publish fixes within days of the upstream SSSD release; subscribe to vendor security mailing lists to track backported patches.

Workarounds

Limit interactive and SSH access to the host so that only vetted users can reach the PAM responder socket.
Enforce SELinux in enforcing mode to constrain unexpected process behavior around SSSD.
Deploy host-based monitoring to detect and automatically restart the PAM responder if it terminates abnormally.

bash

# Configuration example: enable automatic restart for the SSSD PAM responder
sudo systemctl edit sssd-pam.service
# Add the following lines in the override file:
# [Service]
# Restart=always
# RestartSec=2s
sudo systemctl daemon-reload
sudo systemctl restart sssd-pam.service