SSSD EUVD-2026-92891

Exploitation requires that the host be explicitly configured for SSSD KCM credential renewal (KCM renewal mode) - this is the exact feature-dependent prerequisite stated in the description and is not a universal default. The attacker must be an authenticated local user (PR:L) holding a renewable Kerberos ticket-granting ticket, and must induce TGT renewal so the deferred callback fires against freed memory. Limiting factors that reduce real-world risk: local access only (AV:L, no remote vector), valid local authentication and a renewable ticket required, the non-default KCM-renewal configuration dependency, and high attack complexity (AC:H) reflecting the timing-sensitive nature of the use-after-free. Impact is confined to availability of the KCM responder; no confidentiality or integrity impact applies.

This is a genuinely medium/low-priority issue, consistent across signals rather than a high-CVSS-but-low-real-risk mismatch. The vendor CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, 4.7) describes a locally-exploitable, high-complexity, authenticated flaw whose only impact is availability (A:H) with no confidentiality or integrity loss - matching the description, which limits the effect to crashing the KCM responder service (a Denial of Service). AC:H aligns with the fact that the bug is a use-after-free triggered by a deferred callback during TGT renewal, which typically depends on timing/ordering rather than a deterministic single request. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of these signals is expected for a freshly-disclosed local DoS and should not be read as either safety or risk. The practical risk is bounded: an attacker must already be an authenticated local user with a renewable Kerberos ticket on a host specifically configured for KCM renewal, and the payoff is only a service crash, not code execution or data exposure. Note the description says the service crashes but does not state whether it auto-restarts; the real-world impact depends on that behavior, which is not confirmed in the provided data - verify with the Red Hat advisory.

An authenticated local user on a RHEL host that has SSSD KCM renewal enabled holds a renewable Kerberos TGT and drives ticket renewal in a way that triggers the deferred callback to access already-freed memory. The use-after-free crashes the KCM responder, denying Kerberos credential-cache services to all local users until the service recovers. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) implies the trigger is timing-dependent rather than trivially reliable.