CVE-2026-104045: SSSD Autofs Responder DoS Vulnerability

CVE-2026-104045 Overview

CVE-2026-104045 is a race condition vulnerability in the System Security Services Daemon (SSSD) autofs responder. The flaw exists between asynchronous enumeration completion and map invalidation logic. A local, authenticated user can trigger a memory leak by repeatedly sending concurrent map enumeration and invalidation requests. Sustained exploitation causes excessive memory consumption and can disrupt or crash the autofs service. The vulnerability is tracked under CWE-772: Missing Release of Resource after Effective Lifetime.

Critical Impact
Local attackers can exhaust system memory and crash the SSSD autofs responder, disrupting automounted filesystem access for all users on the host.

Affected Products

SSSD (System Security Services Daemon) autofs responder component
Red Hat Enterprise Linux distributions shipping affected SSSD builds
Linux systems using SSSD for autofs map resolution

Discovery Timeline

2026-10-06 - CVE-2026-104045 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104045

Vulnerability Analysis

The vulnerability resides in the SSSD autofs responder, which services automount map lookups for the Linux autofs subsystem. The responder processes enumeration requests asynchronously, returning map entries once backend lookups complete. In parallel, clients can issue invalidation requests to flush cached autofs maps.

When an enumeration and an invalidation operation execute concurrently against the same map, the responder fails to release memory allocated for the in-flight enumeration state. Repeated concurrent requests cause allocated buffers to accumulate in the responder's heap. The responder eventually consumes available memory and either enters a degraded state or is terminated by the kernel out-of-memory killer. Because autofs is a system-wide service, any local user with access to the SSSD socket can cause a denial of service.

Root Cause

The root cause is a missing resource release (CWE-772) along a race window between asynchronous callback completion and map invalidation. When invalidation removes the map context before the enumeration callback fires, the callback loses the reference needed to free its allocated structures. The orphaned allocations are never reclaimed for the lifetime of the responder process.

Attack Vector

Exploitation requires local access and low privileges but no user interaction. An attacker scripts a loop that opens a client connection to the SSSD autofs responder, issues a SSS_AUTOFS_SETAUTOMNTENT_ENUM request, and immediately issues a corresponding invalidation request before enumeration completes. Repeating this pattern across multiple threads amplifies the leak rate. See the Red Hat CVE-2026-104045 advisory and Red Hat Bug Report #2478663 for additional technical context.

Detection Methods for CVE-2026-104045

Indicators of Compromise

Steadily increasing resident set size (RSS) of the sssd_autofs process without corresponding workload growth
sssd_autofs process termination events in journalctl or /var/log/messages with OOM-kill signatures
Repeated short-lived connections from a single local UID to the SSSD autofs responder socket
Autofs mount failures or timeouts reported by clients while SSSD remains running

Detection Strategies

Monitor memory growth of the sssd_autofs process over time and alert on sustained upward trends
Correlate SSSD responder restarts with preceding bursts of autofs enumeration and invalidation requests
Track per-UID request rates against the SSSD autofs socket to identify abusive local processes

Monitoring Recommendations

Ingest systemd and SSSD service logs into a centralized SIEM for longitudinal analysis
Enable SSSD debug logging at level 7 temporarily to capture enumeration and invalidation sequences during investigation
Alert on kernel OOM events naming sssd_autofs as the terminated process

How to Mitigate CVE-2026-104045

Immediate Actions Required

Apply vendor-provided SSSD updates once released by your Linux distribution
Restrict interactive and local shell access on hosts running SSSD with the autofs responder enabled
Restart the sssd service if memory growth is observed to reclaim leaked allocations as a temporary measure

Patch Information

At publication time, refer to the Red Hat CVE-2026-104045 advisory and Red Hat Bug Report #2478663 for patch availability and backports. Apply updated SSSD packages from your distribution's security channel as soon as fixes are published.

Workarounds

Disable the autofs responder in /etc/sssd/sssd.conf by removing autofs from the services directive if automount integration is not required
Enforce resource limits on the sssd_autofs service via a systemd drop-in using MemoryMax= to contain impact
Monitor and automatically restart sssd when memory consumption exceeds a defined threshold

bash

# Example systemd drop-in to cap sssd memory usage
# /etc/systemd/system/sssd.service.d/memory-limit.conf
[Service]
MemoryMax=512M
Restart=on-failure
RestartSec=5s

# Apply the override
sudo systemctl daemon-reload
sudo systemctl restart sssd