CVE-2026-90996: SSSD NSS Responder DOS Vulnerability

CVE-2026-90996 Overview

CVE-2026-90996 is a denial-of-service vulnerability in the System Security Services Daemon (sssd). A local unprivileged user can send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. The malformed request causes the NSS responder to become unstable or terminate. This affects the availability of the system responder, disrupting identity and authentication lookups that depend on sssd.

The flaw is tracked under CWE-191: Integer Underflow and requires no authentication or user interaction beyond local access to the responder socket.

Critical Impact
A local unprivileged attacker can crash the sssd NSS responder, disrupting identity, group, and user lookups across the affected host.

Affected Products

sssd — System Security Services Daemon
Red Hat Enterprise Linux distributions shipping the vulnerable sssd NSS responder
Downstream Linux distributions packaging the affected sssd release

Discovery Timeline

2026-09-14 - CVE-2026-90996 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90996

Vulnerability Analysis

The sssd NSS responder handles requests for user, group, and service lookups on behalf of local processes through the Name Service Switch interface. The responder trusts client-supplied length metadata when parsing incoming requests. A request with a zero-length body triggers an unsafe arithmetic operation classified as an integer underflow ([CWE-191]).

When the responder decrements or offsets a length field derived from the zero-length body, the resulting value wraps around. Subsequent memory operations reference invalid regions, corrupting responder state or terminating the process. Because the NSS responder is a shared system service, its termination affects every consumer of sssd-backed identity data on the host.

Exploitation requires only a local unprivileged account. The attacker does not need elevated capabilities, credentials, or user interaction, and confidentiality and integrity are not affected.

Root Cause

The root cause is missing validation of the request body length in the NSS responder request-parsing path. Length calculations performed on an attacker-controlled zero-length value underflow, producing an oversized unsigned integer that misdirects subsequent parsing or memory access.

Attack Vector

A local user with access to the sssd NSS responder socket crafts a request with a valid header and a zero-length body. The request is submitted through the standard NSS socket interface. The responder parses the header, computes an invalid body length, and enters an unstable state or exits. Repeated requests sustain the denial-of-service condition against processes relying on sssd for identity resolution.

See the Red Hat CVE-2026-90996 Advisory and Red Hat Bug Report #2478986 for vendor technical details.

Detection Methods for CVE-2026-90996

Indicators of Compromise

Unexpected termination or restart of the sssd_nss process recorded in journalctl -u sssd or /var/log/sssd/sssd_nss.log.
Application failures resolving users, groups, or netgroups shortly after unprivileged local activity.
Repeated segmentation faults or ABRT crash reports referencing sssd_nss in /var/log/messages or abrt spool.

Detection Strategies

Monitor systemd service state transitions for sssd and its child responders, alerting on restarts outside change windows.
Correlate NSS lookup failures across host processes with concurrent sssd_nss crash events to identify probable exploitation.
Baseline the rate of connections to the sssd NSS socket at /var/lib/sss/pipes/nss and alert on anomalous bursts from a single local UID.

Monitoring Recommendations

Forward sssd service logs and systemd journal entries to a centralized log platform for retention and search.
Enable core dump collection on sssd_nss to support post-incident analysis of crash-triggering payloads.
Track local process ancestry for accounts issuing NSS requests to identify which users triggered responder failures.

How to Mitigate CVE-2026-90996

Immediate Actions Required

Apply vendor-supplied sssd updates as soon as they are published for your distribution.
Inventory hosts running sssd and prioritize multi-user systems, jump hosts, and shared build infrastructure.
Restrict local shell access on affected hosts to reduce the population of accounts able to reach the NSS responder socket.

Patch Information

Refer to the Red Hat CVE-2026-90996 Advisory for fixed package versions and errata. Track the corresponding Red Hat Bug Report #2478986 for upstream fix status. Downstream distributions rebase on the corrected sssd release once available.

Workarounds

Configure sssd to automatically restart on failure using systemd unit overrides so identity lookups recover quickly after a crash.
Limit interactive local access on sensitive hosts to trusted administrators until patched packages are deployed.
Monitor and alert on sssd_nss termination events to shorten the response window during active abuse.

bash

# Ensure the NSS responder restarts after a crash until the patch is applied
sudo systemctl edit sssd.service
# Add the following in the override file:
# [Service]
# Restart=on-failure
# RestartSec=2s

sudo systemctl daemon-reload
sudo systemctl restart sssd