SSSD CVE-2026-104035

Requires an authenticated local user account on a host running the SSSD KCM (Kerberos Credential Manager) responder - the default SSSD credential-caching backend on RHEL. The attacker must be able to open and maintain a persistent connection to the KCM responder and repeatedly invoke store/destroy credential operations; the leak accumulates only under this sustained store-then-remove pattern. Limiting factors: exploitation is LOCAL only (no network vector), requires valid local access (PR:L), and is bounded to availability impact against the SSSD service on that single host - it does not yield code execution, data disclosure, or privilege escalation, and systems not using the KCM responder are not affected.

This is a moderate, locally-exploitable availability issue, not a high-priority remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: a LOCAL, already-authenticated user (PR:L) triggers an unbounded memory leak in the SSSD KCM responder (CWE-772), yielding availability-only impact (A:H) with no confidentiality or integrity loss. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input; per precision rules this means no public exploit is identified and there is no evidence of active exploitation - the absence of these signals is expected for a recently-disclosed, locally-scoped DoS and should not be read as a mitigating 'low exploitation probability' because the data is simply missing. The signals are not conflicting: both the CVSS vector and the prose agree on local, low-privilege, availability-only exploitation. The realistic risk is a single local user being able to degrade or crash the SSSD service (impacting authentication/identity resolution on that host), which matters most on multi-user systems; it is not a mass-exploitation or remote-compromise scenario.

A logged-in local user on a RHEL host opens a persistent connection to the SSSD KCM responder (e.g. via the Kerberos credential cache) and repeatedly stores and destroys credentials in a tight loop. Because freed credential objects are never released from memory, the responder's footprint grows without bound until memory is exhausted and SSSD becomes unresponsive, disrupting Kerberos/identity services for all users on the host. No public exploit code was identified in the provided data, but the technique requires only ordinary local user access and no special tooling.