Cloudanix VulnDB

CVE-2026-104034

Medium · 4.7

CVSS

4.7

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the system's ticket-handling service can make it crash when users renew certain login tickets, briefly blocking access for everyone relying on that service.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Denial Of Service
Component
Application
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the KCM responder during TGT renewal allows a deferred callback to access released memory, crashing the responder service.

Why it matters to the business

Interrupts Kerberos-based authentication on systems using KCM renewal, causing temporary loss of login and ticket services for users and applications.

How an attack unfolds

An authenticated local user holding a renewable Kerberos TGT triggers renewal processing in the KCM responder; the resulting deferred callback dereferences already-freed memory and terminates the service.

How to fix it

Upgrade SSSD to a version that eliminates the use-after-free in the KCM responder; if no patched release is yet available, disable KCM renewal or restrict local user access to KCM sockets as a temporary control.

How to confirm the fix worked

Confirm the KCM responder no longer crashes under repeated TGT renewal with renewable tickets; review service logs for absence of use-after-free faults after applying updates.

Typical attack path

  1. Obtain local authenticated access on a system using KCM
  2. Acquire or possess a renewable Kerberos TGT
  3. Initiate TGT renewal through the KCM responder
  4. Trigger the use-after-free condition via the deferred callback path
  5. Observe KCM responder crash and resulting denial of service

How to detect it

Inspect system and SSSD logs for repeated KCM responder crashes or segmentation faults coinciding with Kerberos ticket renewal activity; correlate with local user sessions holding renewable tickets.

What your security team should do

  • Prioritize patching SSSD once fixed packages are released
  • Audit systems for KCM renewal configuration and disable where feasible
  • Monitor authentication service availability and set alerts for KCM crashes
  • Restrict local accounts that can interact with KCM to least-privilege principals

The record

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities