SSSD KCM CVE-2026-80048

Exploitation requires the attacker to be a local user or process with the ability to connect to the sssd-kcm UNIX domain socket - i.e., local presence on a host running the SSSD Kerberos Credential Manager (KCM) responder, which must be enabled and in use. The limiting factors are significant: there is no network vector (AV:L), the attacker must already be authenticated/present locally (PR:L), and the impact is confined to availability of the KCM service (memory exhaustion of the responder) with no data disclosure or modification. Hosts not running the kcm responder, or where socket access is restricted, are not affected.

This is a genuine but low-priority denial-of-service issue, not a high-urgency flaw. The CVSS 3.1 score of 5.5 (Medium) is driven entirely by availability impact (A:H) with no confidentiality or integrity impact, and crucially requires local access with privileges: AV:L (local attack vector) and PR:L (an already-authenticated local user or process able to reach the sssd-kcm UNIX socket). The EPSS score of 0.18% (7th percentile) is low and consistent with a local-only DoS that has little mass-exploitation appeal. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The CVSS vector and the Red Hat description agree cleanly - both point to a local, authenticated resource-exhaustion condition (CWE-770, allocation without limits) - so there is no signal conflict to flag. The practical risk is limited to local DoS on multi-user or service-sharing hosts; there is no remote or privilege-escalation dimension. Priority should be routine patching rather than emergency response.

A local user or a compromised low-privilege service process on a Linux host connects to the sssd-kcm UNIX socket and sends a request advertising a very large length header, then deliberately stalls without sending the remaining data. The responder preallocates memory for the claimed request size, and repeated or sustained connections exhaust available memory, crashing or hanging the sssd-kcm responder and denying Kerberos credential-cache services to legitimate users. No public exploit code has been identified, but the technique is simple to reproduce for anyone with local socket access.