CVE-2026-104035 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The identified vulnerability resides within the Kerberos Credential Manager responder component of System Security Services Daemon, a critical identity management framework used in Linux environments to authenticate users against remote directory services such as Active Directory or LDAP. This specific flaw is classified under CWE-401, which describes a missing release of memory after allocation, leading to resource exhaustion. The vulnerability allows any local user with access to the SSSD service to trigger a denial of state condition by exploiting the lifecycle management logic within the KCM responder. By establishing persistent connections and repeatedly storing new Kerberos credentials while simultaneously destroying existing ones, an attacker can manipulate the internal memory handling routines in a way that prevents proper cleanup operations from executing correctly.
From a technical perspective, the core issue is rooted in how SSSD manages its cache for stored authentication tokens. When a credential is removed or destroyed by the user session, the underlying implementation fails to properly deallocate the associated memory structures. This results in a gradual but continuous accumulation of unreleased memory blocks within the process space of the KCM responder. As this cycle repeats over time, the service consumes an increasing amount of system RAM until it reaches the limits imposed by the operating system or available physical resources. Once these limits are exceeded, the SSSD process becomes unresponsive, effectively halting its ability to handle new authentication requests from other legitimate users on the same host.
The operational impact of this vulnerability is significant for environments relying heavily on centralized identity management and single sign-on capabilities. Since SSSD acts as a bridge between local systems and remote directory services, its failure disrupts the entire authentication pipeline. Legitimate users may find themselves unable to log in or maintain active sessions because the service responsible for caching their Kerberos tickets is no longer functioning correctly. This denial of service can lead to widespread productivity loss and potential security gaps if fallback mechanisms are not robustly configured. Furthermore, an attacker could potentially use this resource exhaustion as a precursor to other attacks by forcing system instability or triggering out-of-memory killer events that might inadvertently restart critical services in unpredictable states.
In the context of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1496, which covers Resource Hijacking, specifically through denial of service via resource exhaustion. It represents a local privilege escalation vector where an unprivileged user can degrade system availability without needing elevated permissions to install software or modify kernel parameters. The attack is straightforward and does not require complex exploitation chains, making it accessible to any authenticated local account on the affected system.
Mitigation strategies primarily involve applying vendor-provided patches that address the memory management logic within the KCM responder. Administrators should ensure that SSSD packages are updated to versions where this leak has been resolved by properly implementing reference counting or explicit deallocation routines when credentials are destroyed. In addition to patching, organizations can implement resource limits using cgroups or systemd service configurations to restrict the maximum memory usage of the sssd process. This ensures that even if an attacker attempts to exploit the flaw, the impact is contained within predefined boundaries and does not affect other critical system services. Regular monitoring of SSSD memory consumption patterns can also serve as an early detection mechanism for such abuse attempts.