CVE-2026-104044 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an uninitialized pointer and crashes. This failure disrupts authentication services on the host.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The identified vulnerability resides within the System Security Services Daemon (SSSD), a critical component responsible for accessing remote identity and authentication providers in Linux environments. The flaw specifically affects systems where passkey-based authentication is enabled, leveraging the Kerberos protocol to manage secure access credentials. A local attacker with valid user privileges can exploit this weakness by submitting a specially crafted Pluggable Authentication Module request that targets the passkey handling logic within SSSD. This scenario highlights a significant risk in environments relying on modern authentication methods like FIDO2 or WebAuthn, where the integrity of the underlying daemon is paramount for maintaining system availability and security posture.
The technical root cause of this vulnerability lies in a missing state validation check during the processing of passkey-related Kerberos requests. When SSSD receives such a request, it fails to verify whether the necessary internal states have been properly initialized before proceeding with subsequent operations. Consequently, the PAM responder attempts to dereference an uninitialized pointer within its memory space. In C-based systems like SSSD, accessing invalid or null pointers results in immediate segmentation faults, causing the daemon process to crash abruptly. This behavior classifies the flaw as a classic example of improper input validation leading to resource corruption and application instability, aligning with CWE-94 regarding Improper Control of Generation of Code (Code Injection) or more accurately CWE-824 for Access of Uninitialized Pointer in contexts involving memory safety violations.
The operational impact of this vulnerability is primarily centered on Denial of Service against the host system's authentication infrastructure. Since SSSD often serves as the central point for user authentication, its crash effectively halts all new login attempts and may disrupt existing sessions depending on how the operating system handles daemon failures. For administrators relying on automated scripts or services that authenticate via PAM, this failure can lead to significant downtime and operational disruption. The ability of a local attacker to trigger this condition means that any user account with access to the machine's authentication mechanisms could potentially degrade service availability for all other users, creating an opportunity for localized denial-of-service attacks without requiring elevated privileges beyond standard user access.
From a threat modeling perspective, this vulnerability maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service, where adversaries aim to disrupt the availability of computing resources by exhausting system capacity or causing crashes through malformed inputs. The exploitation vector is local and requires interaction with the PAM subsystem, which typically involves interacting with login processes or service authentication requests. This makes it particularly relevant in multi-user environments such as servers, workstations, or cloud instances where multiple users may attempt to authenticate simultaneously.
Mitigation strategies should focus on both immediate patching and long-term architectural improvements. Administrators must apply the latest security updates provided by their distribution vendors that address this specific flaw in SSSD. In cases where updating is not immediately feasible, disabling passkey authentication if it is not strictly required can reduce the attack surface. Furthermore, implementing strict resource limits on PAM processes using tools like systemd or cgroups can help contain the impact of a crash, preventing it from taking down the entire host system by isolating the SSSD process and allowing for automatic restarts with minimal service interruption. Regular auditing of authentication configurations and ensuring that only necessary authentication modules are enabled will also contribute to reducing exposure to such vulnerabilities.