CVE-2026-90463: SSSD NSS Responder DoS Vulnerability

CVE-2026-90463 Overview

CVE-2026-90463 is an input validation flaw in the System Security Services Daemon (sssd) Name Service Switch (NSS) responder. A local attacker can send specially crafted service lookup requests to the NSS responder's UNIX socket to trigger an out-of-bounds read [CWE-125]. The condition crashes the NSS responder process, producing a denial of service on the affected host.

Unprivileged local clients can typically reach the socket, which broadens the pool of potential attackers on multi-user systems. Red Hat's advisory notes no evidence of privilege escalation or reliable data disclosure from the out-of-bounds read.

Critical Impact
A local, unauthenticated attacker can crash the sssd NSS responder, disrupting name resolution, user lookups, and authentication flows that depend on it.

Affected Products

sssd (System Security Services Daemon) NSS responder component
Red Hat Enterprise Linux distributions shipping the affected sssd package (see vendor advisory)
Downstream Linux distributions consuming the vulnerable sssd release

Discovery Timeline

2026-09-14 - CVE-2026-90463 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90463

Vulnerability Analysis

The sssd NSS responder brokers name service lookups (users, groups, services, netgroups) between local clients and configured identity providers. Local clients communicate with the responder over a UNIX domain socket using a length-prefixed request format. The vulnerability arises when the responder processes malformed service lookup requests without fully validating the bounds of buffer offsets contained in the request payload.

When the responder parses attacker-controlled fields, it reads past the end of the input buffer. This out-of-bounds read [CWE-125] triggers a crash of the responder process. Systems relying on sssd for NSS resolution lose the ability to resolve users, groups, and services until the daemon restarts.

Because the attack vector is local and requires no privileges or user interaction, any local account able to open the responder socket can trigger the crash. The scope is limited to availability; confidentiality and integrity are not directly affected.

Root Cause

The root cause is insufficient bounds validation on fields within service lookup requests received on the NSS responder UNIX socket. The parser trusts length or offset values supplied by the client and dereferences memory outside the allocated request buffer, producing an out-of-bounds read.

Attack Vector

Exploitation requires local access to the sssd NSS responder socket, typically /var/lib/sss/pipes/nss. The attacker crafts a service lookup request with malformed length or offset fields and writes it to the socket. The responder processes the request, reads out of bounds, and terminates. Repeated requests after service recovery can produce a sustained denial of service.

No verified public proof-of-concept is available at publication. Refer to the Red Hat CVE-2026-90463 Advisory and Red Hat Bug Report #2479268 for vendor technical details.

Detection Methods for CVE-2026-90463

Indicators of Compromise

Unexpected termination or repeated restarts of the sssd_nss process, visible in systemd service state or journalctl -u sssd.
Segmentation fault entries or core dumps referencing sssd_nss in /var/log/messages, dmesg, or coredumpctl list.
Failures in user, group, or service name resolution correlated in time with responder crashes.
Unusual local process activity opening /var/lib/sss/pipes/nss from unexpected user accounts.

Detection Strategies

Monitor process exit codes and crash signals for sssd_nss and alert on abnormal termination frequency.
Correlate NSS resolution failures (getent, PAM errors) with responder crash events to identify active exploitation.
Ingest audit logs of connections to the sssd UNIX socket and baseline expected client processes.

Monitoring Recommendations

Enable systemd-coredump and forward core dump metadata to a centralized log platform for analysis.
Track sssd service restart counts as a health metric and alert on threshold breaches.
Review auditd rules to log connect syscalls targeting the sssd pipe directory for forensic visibility.

How to Mitigate CVE-2026-90463

Immediate Actions Required

Apply the updated sssd package from your Linux distribution vendor as soon as it is available.
Inventory systems running sssd and prioritize multi-user hosts, bastions, and shared infrastructure where local access is broader.
Restart the sssd service after patching to ensure the fixed responder binary is loaded.

Patch Information

Refer to the Red Hat CVE-2026-90463 Advisory for fixed package versions and errata affecting Red Hat Enterprise Linux. Consult your distribution's security tracker for equivalent updates on Fedora, CentOS Stream, Debian, Ubuntu, and other downstream builds. The Red Hat Bug Report #2479268 contains additional technical context on the fix.

Workarounds

Restrict local shell access on affected hosts to trusted users until patches are applied.
Configure systemd to automatically restart the sssd service on failure to shorten the availability impact window.
Limit access to the sssd socket directory through filesystem controls where local policy permits.

bash

# Example: enable automatic restart of sssd on failure
sudo systemctl edit sssd
# Add the following in the override file:
# [Service]
# Restart=on-failure
# RestartSec=2s
sudo systemctl daemon-reload
sudo systemctl restart sssd