CVE-2026-90994: SSSD PAM Responder DOS Vulnerability

CVE-2026-90994 Overview

CVE-2026-90994 is an out-of-bounds read vulnerability [CWE-125] in the System Security Services Daemon (SSSD). The flaw resides in the Pluggable Authentication Modules (PAM) responder's protocol v1 parser, specifically the pam_parse_in_data() function. A local client with access to the PAM responder's UNIX socket can negotiate protocol v1 and send an empty or truncated PAM request body. This triggers an out-of-bounds read that can terminate or restart the PAM responder, causing a local denial of service on the affected host.

Critical Impact
Local unauthenticated clients with UNIX socket access can crash the SSSD PAM responder, disrupting authentication services on the affected system.

Affected Products

SSSD (System Security Services Daemon) — PAM responder component
Red Hat distributions shipping the affected SSSD build (see Red Hat CVE-2026-90994)
Linux systems using SSSD for centralized authentication

Discovery Timeline

2026-09-14 - CVE-2026-90994 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90994

Vulnerability Analysis

SSSD provides access to remote identity and authentication providers for Linux systems. The PAM responder handles authentication requests submitted over a local UNIX domain socket. When a client negotiates protocol version 1, the responder invokes pam_parse_in_data() to interpret the request payload.

The parser assumes the request body contains a minimum set of fields. When a client sends an empty or truncated body, the function reads past the end of the allocated buffer. This out-of-bounds read [CWE-125] can trigger a crash in the PAM responder process, and supervising service managers may restart it repeatedly under sustained abuse.

The issue is scoped to local exploitation and does not enable code execution or information disclosure across trust boundaries. Impact is limited to availability of authentication services on the host.

Root Cause

The root cause is missing length validation in pam_parse_in_data(). The parser dereferences fields inside the request body without first verifying that enough bytes were received to satisfy the protocol v1 layout. Empty or truncated messages bypass the implicit size assumption.

Attack Vector

Exploitation requires local access to the PAM responder's UNIX socket. An attacker connects to the socket, negotiates protocol v1, and transmits a malformed PAM request body. No authentication is required beyond socket accessibility. Repeated requests can hold the PAM responder in a crash-restart loop, effectively denying authentication services to legitimate users.

No verified public proof-of-concept code has been released for this issue. See the Red Hat Bug Report #2479455 for vendor technical details.

Detection Methods for CVE-2026-90994

Indicators of Compromise

Unexpected crashes, segmentation faults, or restart events for the sssd_pam process in system journals
systemd or service-manager entries showing repeated respawns of the SSSD PAM responder
Authentication failures or timeouts coinciding with PAM responder unavailability
Local processes with no legitimate need connecting to the SSSD PAM UNIX socket

Detection Strategies

Monitor journalctl -u sssd and /var/log/sssd/sssd_pam.log for abnormal termination messages
Alert on core dumps generated by sssd_pam under /var/lib/systemd/coredump/ or configured coredump paths
Track process restart counters for sssd_pam and flag deviations from baseline restart rates
Correlate PAM responder crashes with local process activity to identify the originating client

Monitoring Recommendations

Baseline normal PAM responder uptime and alert on unexpected respawn events
Audit local access to the SSSD PAM socket path under /var/lib/sss/pipes/
Forward SSSD logs to a centralized logging platform for cross-host correlation
Enable Linux audit rules to record connect() syscalls targeting the PAM responder socket

How to Mitigate CVE-2026-90994

Immediate Actions Required

Apply vendor-supplied SSSD updates as they become available for your distribution
Restrict local shell and container access on hosts running SSSD to trusted users only
Verify filesystem permissions on the SSSD PAM socket directory limit access to expected callers
Enable automatic restart with rate limiting for the SSSD service to reduce impact of crash loops

Patch Information

Refer to the Red Hat CVE-2026-90994 advisory for patched package versions and errata. Distribution maintainers backport fixes to the SSSD pam_parse_in_data() function to validate request length before dereferencing protocol v1 fields. Apply the update through your standard package manager once errata are published.

Workarounds

Limit multi-tenant local access on systems where SSSD is critical for authentication
Configure systemd unit StartLimitBurst and StartLimitIntervalSec to prevent runaway restart cycles
Use SELinux or AppArmor policies to constrain which local processes may connect to SSSD sockets
Monitor and terminate suspicious local processes repeatedly connecting to the PAM responder socket

bash

# Example: harden systemd restart behavior for sssd
# /etc/systemd/system/sssd.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=5s
StartLimitIntervalSec=60
StartLimitBurst=3

# Apply the override
sudo systemctl daemon-reload
sudo systemctl restart sssd