CVE-2026-90995: SSSD PAM Responder DoS Vulnerability

CVE-2026-90995 Overview

CVE-2026-90995 is a NULL pointer dereference vulnerability [CWE-476] in the System Security Services Daemon (SSSD). The flaw resides in the Pluggable Authentication Modules (PAM) responder component. A local attacker with permission to connect to the PAM responder socket can send a crafted protocol request that omits the service item. When the pam_app_services configuration is enabled, the responder dereferences a NULL pointer and crashes. The resulting denial of service disrupts authentication across affected systems.

Critical Impact
A local attacker can crash the SSSD PAM responder, blocking user authentication on affected Linux systems and disrupting identity services.

Affected Products

System Security Services Daemon (SSSD)
Red Hat Enterprise Linux distributions shipping affected SSSD versions
Linux systems with pam_app_services configuration enabled

Discovery Timeline

2026-09-14 - CVE-2026-90995 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-90995

Vulnerability Analysis

SSSD provides access to remote identity and authentication providers on Linux systems. The PAM responder handles authentication requests submitted through a local Unix domain socket. When pam_app_services is configured, the responder processes application-specific service definitions during request parsing.

The vulnerable code path expects a service item in the incoming PAM protocol request. If the attacker omits this item, the responder does not validate the field before dereferencing it. The resulting NULL pointer dereference terminates the responder process. Authentication and account management operations that depend on SSSD fail until the daemon restarts.

The attack requires only local access with the low privileges needed to connect to the PAM responder socket. No user interaction is required, and complexity is low.

Root Cause

The root cause is missing input validation in the PAM protocol parser. The responder assumes the service item is always present when pam_app_services is enabled and does not perform a NULL check before use. This maps to CWE-476: NULL Pointer Dereference.

Attack Vector

Exploitation is local. An attacker with an account on the target system opens a connection to the PAM responder socket and sends a protocol request that omits the service item field. Processing the malformed request triggers the NULL pointer dereference and crashes the responder. Repeated exploitation prevents recovery of authentication services on the host.

No public proof-of-concept exploit is available for CVE-2026-90995 at the time of publication. Refer to the Red Hat CVE-2026-90995 Advisory and Red Hat Bug Report #2479464 for vendor technical details.

Detection Methods for CVE-2026-90995

Indicators of Compromise

Unexpected termination or repeated restarts of the sssd_pam responder process in systemd journal or /var/log/sssd/sssd_pam.log.
Authentication failures across services that rely on SSSD, particularly following local socket activity from unprivileged users.
Core dumps generated by the SSSD PAM responder process on hosts where pam_app_services is enabled.

Detection Strategies

Monitor SSSD log files for parser errors, abort messages, or segmentation faults associated with the PAM responder.
Correlate PAM responder crashes with local user process activity connecting to /var/lib/sss/pipes/pam or related sockets.
Alert on abnormal spikes in PAM authentication failures that follow SSSD service restarts.

Monitoring Recommendations

Enable auditd rules covering connections to the SSSD PAM socket and track the initiating user and process.
Forward sssd_pam logs and systemd unit state changes to a centralized SIEM for correlation.
Track service uptime metrics for sssd.service and alert when the PAM responder restarts outside of maintenance windows.

How to Mitigate CVE-2026-90995

Immediate Actions Required

Apply the SSSD security update published by your Linux distribution as soon as it is available.
Audit sssd.conf for pam_app_services usage and disable the setting where it is not required.
Restrict local shell access on multi-user systems to reduce the population of accounts capable of reaching the PAM socket.

Patch Information

Refer to the Red Hat CVE-2026-90995 Advisory for patched package versions and errata identifiers. Additional developer discussion is available in the Red Hat Bug Report #2479464. Apply vendor-supplied SSSD updates through the standard package manager (dnf update sssd on Red Hat family systems).

Workarounds

Disable pam_app_services in sssd.conf on hosts that do not require application-specific PAM service handling.
Tighten filesystem permissions and access controls on the PAM responder socket to limit which local users can connect.
Configure systemd to automatically restart sssd on failure to reduce authentication downtime while patches are staged.

bash

# Configuration example: disable pam_app_services and enable auto-restart
# 1. Edit /etc/sssd/sssd.conf and remove or comment out pam_app_services
#    under the [pam] section, then restart SSSD.
sudo sed -i 's/^pam_app_services/#pam_app_services/' /etc/sssd/sssd.conf
sudo systemctl restart sssd

# 2. Ensure systemd restarts SSSD on unexpected failure
sudo systemctl edit sssd.service
# Add the following override:
# [Service]
# Restart=on-failure
# RestartSec=5s