CVE-2026-12610

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.

Security Fix(es):

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.(CVE-2026-12610)

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.(CVE-2026-14476)

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.

Security Fix(es):

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.(CVE-2026-12610)

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.(CVE-2026-14476)

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.

Security Fix(es):

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.(CVE-2026-12610)

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.(CVE-2026-14476)

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.

Security Fix(es):

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.(CVE-2026-12610)

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

• CVE-2026-12610: dereference the PAM context's certificate-map context when the p11_child response is parsed instead of caching it in the request state, fixing a use-after-free when a domain refresh replaced it mid-smartcard-authentication

• CVE-2026-12610: fix PAM responder use-after-free during asynchronous p11_child processing

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issue:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issues:

• CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed (bsc#1273925).
• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).

This update for sssd fixes the following issues:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).
• CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read (bsc#1273922).
• CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads (bsc#1273925).
• CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure (bsc#1273924).
• CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584).
• CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360).
• CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361).
• CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362).
• CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363).
• CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326).
• CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314).
• CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316).
• CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318).
• CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321).
• CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322).
• CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323).
• CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder (bsc#1284324).
• CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266).
• CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).

It was discovered that the SSSD PAM responder may crash if a physically proximate attacker manipulates a smartcard or Yubikey. Non-malicious physically proximate users may not be able to log in depending upon the details of their legitimate smartcard or Yubikey.