CVE-2026-104041 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within the System Security Services Daemon presents a critical resource management flaw that allows for a local denial-of-service attack through cache manipulation. SSSD serves as a central identity and authentication provider in Linux environments, handling lookups via its Name Service Switch responder to maintain consistency across various services such as login, sudo, and SSH. The core technical issue lies in the implementation of the negative caching mechanism, which is designed to store results for queries that return no data, thereby preventing repeated expensive backend lookups for nonexistent users or groups. However, this cache lacks a maximum size limit or an eviction policy based on total entry count. Instead, it relies solely on time-based expiration where records are only removed when their specific keys are re-evaluated and found to be expired. This design oversight means that as long as new unique queries for nonexistent entries continue to arrive, the negative cache will expand indefinitely without ever purging old data unless those specific entries happen to expire during a subsequent check.
From an operational perspective, this unbounded growth of the negative cache leads directly to excessive memory consumption on the host system. An unprivileged local user can exploit this behavior by systematically requesting lookups for a large number of unique nonexistent usernames or group names in rapid succession. Each request adds a new entry to the cache that persists until its individual timeout expires, which may be configured with a relatively long duration to optimize performance against legitimate lookup patterns. As the memory footprint of the SSSD process increases, it eventually consumes all available system resources allocated to the daemon or triggers out-of-memory conditions within the operating kernel. This results in the responder becoming unresponsive or terminating abruptly, effectively causing a Denial of Service for any local service that depends on SSSD for identity resolution. Users attempting to log in, authenticate via SSH, or execute privileged commands may find themselves unable to do so because the underlying authentication infrastructure has failed due to resource exhaustion.
This vulnerability aligns with CWE-400, which describes a class of issues where resources are not properly controlled, leading to denial-of-service conditions through uncontrolled consumption of system resources such as memory or disk space. Furthermore, in the context of the MITRE ATT&CK framework, this exploitation technique maps to T1498 Network Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer attacks. While typically associated with network-based floods, local privilege escalation scenarios where a low-privileged user disrupts system stability are also categorized under similar principles of availability impact. The attack vector is classified as Local (L), requiring physical or shell access to the target machine, and does not require authentication beyond standard login credentials for an unprivileged account, making it accessible to any legitimate but malicious insider or attacker who gains initial foothold on the system through other means such as phishing or weak password policies.
Mitigation strategies must focus on implementing strict limits on cache size and improving eviction logic within SSSD configurations. Administrators should review current negative caching settings and consider reducing the timeout values for failed lookups to ensure that stale entries do not persist unnecessarily long, although this may increase backend load if misconfigured. More critically, a software patch is required to enforce a maximum limit on the number of cached negative results or implement an LRU (Least Recently Used) eviction policy when the cache reaches a defined threshold. Until such patches are applied in production environments, monitoring tools should be deployed to track memory usage trends for SSSD processes and alert administrators if abnormal growth patterns indicative of this exploitation attempt are detected. Additionally, restricting local login access through strict PAM configurations can reduce the attack surface available to unprivileged users attempting to trigger this condition.