CVE-2026-90995 in Red Hat
Summary
by MITRE • 09/14/2026
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The System Security Services Daemon serves as a critical component in Linux environments for managing identity and access control, particularly when integrated with centralized directory services such as Active Directory or LDAP. Within this architecture, the Pluggable Authentication Modules responder handles authentication requests from local applications by communicating with backend providers. A significant security flaw has been identified within this specific subsystem, where improper validation of input parameters allows a local attacker to trigger a critical failure in the daemon's operation. The vulnerability stems from an insufficient check on protocol requests sent via the PAM responder socket, specifically when the pam_app_services configuration option is enabled but the service item field is omitted or left empty in the request payload.
From a technical perspective, this oversight results in a NULL pointer dereference within the SSSD codebase. When the daemon processes an authentication request lacking the required service identifier under the specified configuration state, it attempts to access memory locations that have not been properly initialized due to the missing data. This logical error causes the process to crash immediately upon handling the malformed packet. The absence of robust boundary checking and default value assignment for optional fields in this context creates a direct path to application instability. Such errors are characteristic of CWE-476, which describes NULL pointer dereference vulnerabilities that occur when software attempts to use an object or reference with a null value as if it were valid memory.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. Because the PAM responder process terminates unexpectedly upon receiving the crafted request, any ongoing authentication operations are interrupted. This leads to a denial of service condition where legitimate users may be unable to log in or maintain active sessions until the SSSD daemon is manually restarted by an administrator with appropriate privileges. While this does not directly allow for privilege escalation or remote code execution, it effectively disrupts local access controls and can cause significant downtime in environments relying heavily on automated authentication workflows. The attack requires only local access and basic permissions to connect to the PAM socket, making it accessible to any user account that has been granted standard interaction rights with system services.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-technique for resource exhaustion or service disruption through application crashes. It also relates to CWE-20, Improper Input Validation, as the root cause is the failure to validate that required fields are present before processing them. The attack vector is local and requires low complexity, meaning an attacker does not need sophisticated tools or multiple steps to exploit it beyond crafting a specific network packet sent over the local socket interface.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Administrators must apply vendor-provided patches that address this NULL pointer dereference as soon as they become available, ensuring that SSSD is updated to versions where input validation for service identifiers has been strengthened. In environments where patching cannot be performed immediately, restricting access to the PAM responder socket can serve as a temporary control measure. This involves configuring file system permissions so that only trusted processes or users with elevated privileges can interact with the socket, thereby preventing unprivileged local accounts from sending crafted requests. Additionally, implementing monitoring solutions that detect unexpected process terminations of SSSD components can aid in rapid incident response and recovery.