CVE-2026-104035

What it actually does

Local attacker with a persistent connection to the KCM responder can repeatedly invoke credential store and destroy operations; the responder fails to release cached objects on destroy, producing unbounded memory growth that exhausts RAM and renders the service unresponsive.

Why it matters to the business

Authentication and credential-handling services on affected systems become unavailable, disrupting user logins, sudo, and any Kerberos-dependent applications until the service is restarted or the host is rebooted.

How an attack unfolds

An attacker with a local account opens a long-lived connection to the KCM responder and enters a tight loop that stores then immediately destroys credentials; because memory is never reclaimed, resident set size grows until the OOM killer or manual intervention is required.

How to fix it

Upgrade SSSD to a version containing the memory-release fix for the KCM responder; if no patched package is yet available, restrict local access to the KCM interface via systemd unit hardening or SELinux policy until an update can be applied.

How to confirm the fix worked

Confirm SSSD package version is newer than the vulnerable release; run a synthetic load test that repeatedly stores and destroys credentials while monitoring resident memory of the KCM process to verify it remains bounded.

Typical attack path

1. Obtain local shell or unprivileged account on the host
2. Connect persistently to the KCM socket or D-Bus interface
3. Loop: store arbitrary credential blob, immediately destroy it
4. Monitor memory consumption until service becomes unresponsive

How to detect it

Inspect system logs and process accounting for repeated KCM store/destroy sequences from the same UID; correlate with abrupt increases in sssd memory usage or OOM events targeting the KCM responder.

What your security team should do

• Apply the SSSD security update within the next maintenance window
• Add monitoring for sudden growth in sssd_kcm memory usage
• Review local user accounts and limit KCM access where feasible