CVE-2026-104034

MediumCVSS 4.7/10Last modified Oct 6, 2026

Description

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-825

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 6, 2026
Last modified: Oct 6, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1040355.5A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS)CVE-2026-1040365.8A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destinat CVE-2026-1040375.5A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to th CVE-2026-1040385.9A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security CVE-2026-1040394.7A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Gener CVE-2026-1040406.1A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly CVE-2026-1040415.5A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch CVE-2026-1040425.5A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) re CVE-2026-1040435.5A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underfl CVE-2026-1040446.2A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Mod CVE-2026-1040454.7A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between CVE-2026-1040466.2A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication reque