CVE-2026-68742: SSSD NSS Responder DoS Vulnerability

CVE-2026-68742 Overview

CVE-2026-68742 is an out-of-bounds read vulnerability in the System Security Services Daemon (SSSD). The flaw resides in the sss_nss_protocol_parse_addr() function within the Name Service Switch (NSS) responder. The function fails to validate the addrlen field against the remaining packet body size when processing client requests.

A local attacker with the ability to communicate with the NSS responder socket can send a crafted GETHOSTBYADDR request. The malformed request triggers an out-of-bounds read that crashes the SSSD process, producing a denial of service condition on the affected host.

Critical Impact
A local, low-privileged attacker can crash the SSSD NSS responder, disrupting name resolution, authentication, and identity lookups on the affected system.

Affected Products

SSSD (System Security Services Daemon) — NSS responder component
Red Hat Enterprise Linux distributions bundling the vulnerable SSSD build (see Red Hat CVE Report)
Downstream Linux distributions shipping the affected SSSD version

Discovery Timeline

2026-08-03 - CVE-2026-68742 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-68742

Vulnerability Analysis

SSSD is a system daemon that provides access to identity and authentication providers such as LDAP, Kerberos, and Active Directory. The NSS responder processes client lookups over a UNIX domain socket, including hostname-to-address and address-to-hostname queries.

When a client submits a GETHOSTBYADDR request, sss_nss_protocol_parse_addr() reads an addrlen field from the request body. The function then reads addrlen bytes as the address payload without confirming that addrlen does not exceed the remaining packet body. The mismatch enables an out-of-bounds read past the request buffer.

The read triggers a crash of the responder process, terminating the service and blocking subsequent identity and authentication lookups. Successful abuse requires local access to the responder socket but no elevated privileges.

Root Cause

The root cause is missing input validation, classified as [CWE-125] Out-of-Bounds Read. The parser trusts the attacker-controlled addrlen value without bounding it against the remaining payload length before dereferencing the buffer.

Attack Vector

A local user crafts a malformed GETHOSTBYADDR request and writes it to the SSSD NSS responder UNIX socket. The oversized addrlen field forces the responder to read beyond the request buffer, causing an immediate process termination and denial of service against the host's name resolution and authentication path.

Refer to the Red Hat Bug Report for additional technical details on the affected code path.

Detection Methods for CVE-2026-68742

Indicators of Compromise

Unexpected sssd_nss process crashes or repeated respawn events in systemd journal logs
Segmentation fault entries in /var/log/messages or dmesg referencing the SSSD NSS responder
Sudden failures in host lookups, getent hosts, or authentication flows dependent on SSSD
Core dumps generated for the sssd_nss binary on systems where core capture is enabled

Detection Strategies

Monitor systemd service state changes for the sssd and sssd-nss units, alerting on abnormal restart counts
Correlate local user activity with SSSD crash events to identify potential exploitation attempts
Audit connections to the NSS responder UNIX socket using auditd rules on the SSSD pipe directory

Monitoring Recommendations

Forward SSSD logs and systemd-coredump events to a centralized log platform for correlation
Alert on repeated sssd_nss termination signals within short time windows on the same host
Track authentication failure spikes that coincide with SSSD service instability

How to Mitigate CVE-2026-68742

Immediate Actions Required

Apply the vendor-supplied SSSD security update as soon as it becomes available for your distribution
Restrict local user access on shared systems running SSSD, particularly multi-tenant hosts
Enable automatic restart of the SSSD service to reduce downtime if the responder crashes
Review local account inventory and remove unnecessary interactive accounts on identity-critical hosts

Patch Information

Track fix availability through the Red Hat CVE Report and the corresponding Red Hat Bug Report. Downstream distributions will ship updated SSSD packages that add bounds checks on the addrlen field within sss_nss_protocol_parse_addr().

Workarounds

Limit local shell access to trusted administrators until patches are applied
Configure systemd to automatically restart the SSSD service on failure to preserve availability
Where feasible, isolate identity-dependent workloads on hosts with reduced local user exposure

bash

# Configuration example: enable automatic restart for SSSD via systemd override
sudo systemctl edit sssd.service
# Add the following in the override file:
# [Service]
# Restart=always
# RestartSec=5s
sudo systemctl daemon-reload
sudo systemctl restart sssd