sssd EUVD-2026-92914

Exploitation requires that sssd passkey authentication is enabled on the host - this is a non-default configuration and is the primary limiting factor. The attacker must have local access to the host to submit a PAM request that reaches the passkey Kerberos handling code path; remote exploitation is not possible (AV:L). No special privileges or user interaction are required (PR:N/UI:N), so any local user able to invoke PAM can attempt it. Impact is limited to availability (crash/DoS of the PAM responder and authentication services); there is no confidentiality or integrity impact. Hosts not using passkey authentication are not exposed.

This is a moderate-severity, availability-only vulnerability (CVSS 6.2, A:H with C:N/I:N) in sssd, confirmed and reported by Red Hat. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U) indicates a local, low-complexity attack requiring no prior privileges or user interaction, which is why a NULL-pointer DoS scores as high as 6.2 - a local user can repeatedly crash the authentication daemon. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The practical risk is materially constrained by two factors not reflected in the raw score: exploitation requires local access to the host, and it only applies when passkey authentication is enabled (a non-default configuration), so most deployments are not exposed. Note one nuance to verify: the CVSS vector lists PR:N (unauthenticated), but the attack targets the PAM authentication flow itself - this is consistent (an unauthenticated local user can send PAM requests), but defenders should confirm that reaching the vulnerable passkey Kerberos code path does not implicitly require some prior credential. This is a real but lower-tier priority: patch on multi-user hosts that use passkey/Kerberos authentication, but it is not an emergency for single-admin or non-passkey systems.

A local, unprivileged user on a host where sssd passkey authentication is enabled sends a specially crafted PAM request that reaches the passkey Kerberos handling path. Because a state-validation check is missing, the PAM responder dereferences an uninitialized pointer and crashes, disrupting authentication services for all users on that host. No public exploit code was identified in the provided data, and repeated triggering could sustain a denial of service on the authentication subsystem.