CVE-2026-104045 Red Hat CVE debrief

Who should care

System administrators and defenders responsible for managing and securing systems that use SSSD, particularly those with local user access, should be aware of this vulnerability and take steps to verify and patch affected systems.

Why it matters

Defenders should prioritize verifying and patching affected systems, particularly those with local user access, to prevent potential DoS attacks. The vulnerability can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.

• Potential disruption or crash of the autofs service due to excessive memory consumption
• Increased risk of Denial of Service (DoS) attacks by local users
• Need for verification and patching of affected systems to prevent potential attacks

Technical summary

A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service. This issue is particularly relevant for defenders and system administrators managing systems that use SSSD, as they need to verify and patch affected systems to prevent potential attacks. The vulnerability highlights the importance of securing systems against local user exploits and ensuring timely patching and updates.

Defensive priority

Defenders should prioritize verifying and patching affected systems, particularly those with local user access, to prevent potential DoS attacks.

Recommended defensive actions

• Verify and patch affected systems, particularly those with local user access
• Monitor system logs for potential DoS attacks
• Implement compensating controls to limit local user access
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected products. However, specific versions of the affected products and remediation steps are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.