Linux CVE-2025-11561

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

Systems running SSSD (System Security Services Daemon) on Linux in Active Directory integrated environments are affected, particularly Red Hat Enterprise Linux versions as indicated by the numerous Red Hat Security Advisories (RHSA-2025:19610 through RHSA-2025:21795). The vulnerability affects SSSD installations where the Kerberos local authentication plugin is enabled in default configurations with potential fallback to the an2ln plugin. Multiple Red Hat Enterprise Linux versions including RHEL 7, 8, and 9 variants are confirmed affected based on the advisory references.