SSSD CVE-2026-104039

Requires a local, already-authenticated user (AV:L, PR:L) able to communicate with the SSSD PAM responder, and the system must be using GSSAPI authentication handled by that responder. The attacker must complete a GSSAPI authentication request and then send a further request over the same connection after its cached state has been freed. Exploitation is limited by: local access only (no remote/network path), the need for valid low-level credentials on the host, high attack complexity (AC:H) because the dangling-pointer dereference depends on request timing/sequencing over a reused connection, and the requirement that GSSAPI auth via the PAM responder is actually in use. Impact is confined to availability (crash/DoS of authentication services); no confidentiality or integrity effect.

This is a genuinely medium/low-priority issue rather than an urgent one. The CVSS 3.1 base score of 4.7 (Medium) is driven by availability-only impact (C:N/I:N/A:H) and is heavily constrained by three local-side factors in the vector: local attack vector (AV:L), high attack complexity (AC:H), and required privileges (PR:L), meaning an already-authenticated local user is needed. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input. Red Hat is the reporting source and the only references are the Red Hat CVE page and Bugzilla, both of which currently return no public exploit detail. There is no active-exploitation signal: no public exploit identified at time of analysis. The signals are internally consistent - a local, authenticated, complexity-gated availability bug - so there is no CVSS-vs-description conflict to flag. The CWE-825 (expired/dangling pointer dereference, use-after-free on the freed connection state) crashes the SSSD responder; because SSSD mediates system authentication, the practical blast radius is a local DoS of auth services, not remote compromise or data exposure. Bottom line: patch in normal cycle; this is not a widespread-exploitation emergency.

A local user who can reach the SSSD PAM responder socket performs a GSSAPI authentication over a connection, then issues an additional request on that same connection after the cached connection state has been freed. The dangling reference pointer is dereferenced, the SSSD responder accesses invalid memory and terminates, disrupting authentication for the host. No public exploit code was provided in the input, and the AC:H rating implies the triggering sequence is not trivially reliable.