CVE-2026-80048 Overview
CVE-2026-80048 is an uncontrolled resource consumption flaw [CWE-770] in sssd-kcm, the Kerberos Credential Manager responder component of the System Security Services Daemon (SSSD). A local user or process able to connect to the sssd-kcm UNIX socket can send a large request length header and then stall the connection. The responder preallocates memory based on the attacker-supplied length, leading to memory exhaustion. The result is a Denial of Service (DoS) condition affecting the sssd-kcm service and credential operations that depend on it.
Critical Impact
Any local account or process with socket access can exhaust sssd-kcm memory, disrupting Kerberos credential caching across the host.
Affected Products
- sssd-kcm responder in the SSSD project
- Red Hat Enterprise Linux distributions shipping affected sssd-kcm builds (see vendor advisory)
- Downstream Linux distributions packaging the vulnerable SSSD versions
Discovery Timeline
- 2026-10-07 - CVE CVE-2026-80048 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-80048
Vulnerability Analysis
The sssd-kcm responder listens on a local UNIX domain socket and serves Kerberos credential cache requests from local clients. Each incoming request begins with a length header that tells the responder how large the subsequent payload will be. The responder uses that header to allocate buffer memory before the full payload arrives.
An attacker can send an inflated length value and then withhold the remaining bytes. The responder holds the preallocated buffer while waiting on the stalled connection. Repeating this across many connections multiplies the memory committed by the daemon. Eventually sssd-kcm consumes available memory and becomes unable to service legitimate credential requests, breaking workflows that depend on Kerberos ticket caching.
Root Cause
The root cause is missing input validation and resource governance on the request length header, classified under [CWE-770] Allocation of Resources Without Limits or Throttling. The responder trusts a client-supplied size and allocates eagerly, with no upper bound, no per-client quota, and no timeout tied to buffer reclamation on stalled connections.
Attack Vector
Exploitation requires local access to the sssd-kcm UNIX socket. An unprivileged user or compromised service account that can open the socket sends crafted request headers advertising large payload sizes and then stops writing. Repeating this across many concurrent sockets drives the responder's resident memory up until allocations fail or the OOM killer intervenes.
No code example is published for this issue. Refer to the Red Hat CVE-2026-80048 Advisory and Red Hat Bug Report #2479377 for vendor-provided technical detail.
Detection Methods for CVE-2026-80048
Indicators of Compromise
- Sustained growth in resident memory of the sssd_kcm process without a matching increase in legitimate Kerberos activity.
- Multiple concurrent client connections to the sssd-kcm UNIX socket that remain open without completing requests.
- Failures from kinit, klist, or application Kerberos operations citing credential cache errors after the daemon becomes unresponsive.
- OOM killer events in dmesg or the journal naming sssd_kcm or related SSSD processes.
Detection Strategies
- Monitor per-process memory metrics for sssd_kcm and alert on sudden or sustained increases beyond baseline.
- Track the count of open file descriptors and active socket connections held by the sssd_kcm process.
- Correlate sssd-kcm service restarts or crashes with preceding spikes in local socket connection rates.
Monitoring Recommendations
- Collect sssd and sssd_kcm logs with debug level sufficient to record client connection and request lifecycle events.
- Forward systemd journal entries for the sssd-kcm.service unit to a central log pipeline for anomaly review.
- Alert on repeated restarts of the sssd-kcm.service unit within a short interval.
How to Mitigate CVE-2026-80048
Immediate Actions Required
- Apply vendor-provided sssd package updates as soon as fixed builds are available from your Linux distribution.
- Restrict which local users and services can reach the sssd-kcm socket on multi-tenant or shared hosts.
- Audit non-interactive and service accounts for unnecessary access to the host, reducing the pool of actors able to connect locally.
Patch Information
At publication, consult the Red Hat CVE-2026-80048 Advisory for fixed package versions and errata. Downstream distributions typically track the upstream SSSD fix; verify against your distribution's security tracker before deploying to production.
Workarounds
- If sssd-kcm is not required, disable and mask the sssd-kcm.socket and sssd-kcm.service units to remove the attack surface.
- Apply resource limits to the sssd-kcm.service systemd unit, such as MemoryMax and TasksMax, to contain memory growth until a patch is applied.
- Limit local shell access and audit container or multi-user environments where untrusted processes share the host with sssd-kcm.
# Example containment: cap sssd-kcm memory via a systemd drop-in
sudo systemctl edit sssd-kcm.service
# In the editor, add:
# [Service]
# MemoryMax=256M
# TasksMax=256
sudo systemctl daemon-reload
sudo systemctl restart sssd-kcm.service
# If sssd-kcm is not needed, disable the socket and service
sudo systemctl disable --now sssd-kcm.socket sssd-kcm.service
sudo systemctl mask sssd-kcm.socket sssd-kcm.service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
