SSSD EUVD-2026-94006

Requires local, authenticated access to a host where the SSSD autofs responder is active and processing map enumeration - i.e., SSSD configured with the autofs service enabled. The attacker must repeatedly send concurrent map enumeration and map invalidation requests to hit the narrow timing window between asynchronous enumeration completion and map invalidation. Exploitation is limited by several factors: it cannot be performed remotely (AV:L), it requires valid local credentials (PR:L), and it depends on reliably winning a race condition (AC:H), which makes successful, sustained exploitation timing-dependent and non-deterministic. Hosts not running the autofs responder are not exposed. Impact is confined to availability (crash/degradation of the autofs service) with no data exposure or modification.

This is a low-to-moderate real-world priority despite the enterprise ubiquity of the affected software. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7 Medium) signals the practical limits clearly: exploitation is local only (AV:L), requires an already-authenticated local user (PR:L), and depends on winning a timing race condition (AC:H), with impact confined to availability (A:H) - no confidentiality or integrity loss. The sole impact is a memory leak (CWE-772) in the SSSD autofs responder that, if the race is repeatedly won, exhausts memory and crashes or degrades the autofs service. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of local-only access, authenticated prerequisite, high attack complexity, and availability-only impact means this is a genuine but low-urgency DoS bug - not a high-severity remote threat. There is no conflict among the available signals; the main gap is the absence of any exploitation-probability data (EPSS) and patch/fixed-version detail in the provided input.

An authenticated local user on a RHEL or OpenShift host running SSSD with the autofs responder active writes a loop that repeatedly fires concurrent autofs map enumeration and map-invalidation requests, aiming to hit the race window between asynchronous enumeration completion and invalidation. Each won race leaks memory; sustained over time this drives excessive memory consumption that disrupts or crashes the autofs service. No public exploit code was identified, and success depends on reliably winning a timing-sensitive race (AC:H).