SSSD CVE-2026-88252

Requires an authenticated local user (PR:L, AV:L) able to open and sustain a large number of concurrent connections to an sssd responder socket (e.g. the NSS or PAM responder UNIX socket) while continuing to queue new connection attempts, which drives the responder past its file-descriptor limit into an unthrottled retry loop. Exploitation is LIMITED by the need for local access and by high attack complexity (AC:H) - the attacker must sustain enough concurrent connections and queued attempts to exhaust descriptors; there is no remote, unauthenticated, or user-interaction path. Realistic risk is concentrated on shared/multi-user hosts, while single-admin systems have little exposure.

All signals point to a genuinely low-to-moderate priority issue rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7 Medium) describes a local, authenticated, high-complexity attack with no confidentiality or integrity impact and only an availability (DoS) impact, consistent with CWE-835 (unthrottled/infinite retry loop). No EPSS score, CISA KEV listing, SSVC decision data, or proof-of-concept was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The requirement for local access (AV:L) plus elevated attack complexity (AC:H) substantially limits real-world risk: an attacker already needs a local foothold, and the payoff is only denial of service of the sssd responder (identity/authentication), not code execution or data disclosure. This is a reliability/availability hardening fix, not a high-urgency remotely exploitable vulnerability; the primary exposure is multi-user or shared hosts where an untrusted local user could degrade authentication for everyone.

A logged-in local user on a RHEL host runs a small script that opens and holds many simultaneous connections to an sssd responder socket while continuously queuing further connection attempts. Once the responder's file descriptors are exhausted, the service enters an unthrottled retry loop, spiking CPU and stalling, so legitimate NSS/PAM identity and authentication lookups for all users fail. No public exploit code was provided, and the high attack complexity (AC:H) means reliable triggering may require tuning connection timing and volume.