CVE-2026-104044

What it actually does

The PAM responder dereferences an uninitialized pointer in passkey Kerberos handling due to absent state validation, resulting in a crash of the authentication service.

Why it matters to the business

Authentication services become unavailable on affected hosts until the process is restarted, interrupting user logins and system access with no data loss or remote access risk.

How an attack unfolds

A local attacker on a host with passkey authentication enabled crafts a malformed PAM request that bypasses state checks in the Kerberos handling path, causing the responder to crash on pointer dereference.

How to fix it

Upgrade sssd to a patched release that adds the missing state validation in passkey Kerberos handling; if immediate update is not possible, consider disabling passkey authentication until the fix is applied.

How to confirm the fix worked

Confirm sssd version contains the state validation fix, review source or changelog for the pointer initialization check, and test that crafted PAM requests no longer cause responder crashes.

Typical attack path

1. Gain local access to a host running sssd with passkey authentication enabled
2. Prepare a specially crafted PAM request targeting the passkey Kerberos code path
3. Submit the request to the PAM responder to trigger uninitialized pointer dereference
4. Observe service crash and resulting denial of authentication

How to detect it

Review system and sssd logs for segmentation faults or crashes originating from the PAM responder process shortly after authentication attempts; correlate with passkey-enabled configurations.

What your security team should do

• Prioritize patching sssd on all systems where passkey authentication is enabled
• Monitor vendor advisories for the exact fixed version and schedule deployment
• Temporarily disable passkey authentication in sssd configuration on high-risk hosts if patching is delayed
• Add monitoring for sssd PAM responder crashes in system logs