CVE-2026-104042

What it actually does

The vulnerability allows a local attacker to trigger a denial of service by sending a malformed PAM request with a zero-length authentication token to the responder socket, leading to an out-of-bounds read and crash of the PAM responder process due to missing input validation.

Why it matters to the business

Disrupts authentication services on affected systems, causing temporary unavailability of login and access management until the crashed service is restarted.

How an attack unfolds

An attacker with local access crafts a PAM request containing a zero-length authentication token and transmits it directly to the SSSD PAM responder socket. The absence of proper length validation causes the service to attempt reading beyond allocated buffer boundaries, resulting in a crash.

How to fix it

Update SSSD packages to versions containing input validation corrections for PAM token handling. Restart affected services after patching and test authentication flows.

How to confirm the fix worked

Confirm upgraded SSSD package versions via package manager, review changelog entries for PAM input fixes, and perform functional testing of PAM-based logins including edge-case token scenarios.

Typical attack path

1. Obtain local user access on the target system
2. Craft a malicious PAM authentication request embedding a zero-length token
3. Transmit the request to the SSSD responder socket
4. Trigger the out-of-bounds read and observe the PAM responder crash

How to detect it

Review system and application logs for repeated SSSD PAM responder crashes, segmentation faults, or abnormal termination events around PAM request processing times.

What your security team should do

• Apply SSSD updates as soon as vendor packages become available
• Limit local account privileges to reduce attack surface
• Enable process monitoring and automatic restart for the PAM responder
• Audit PAM configurations for unnecessary exposure of the responder socket