CVE-2026-80048
Sssd: sssd-kcm: local denial of service via excessive memory preallocation
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Sssd: sssd-kcm: local denial of service via excessive memory preallocation
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
- Record
CVE-2026-80048- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-06
EUVDEUVD-2026-94103
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
- Record
EUVD-2026-94103- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-m2fx-2vhw-gg64
A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX...
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
- Record
GHSA-m2fx-2vhw-gg64- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
- Record
CVE-2026-80048- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-80048
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
- Record
DEBIAN-CVE-2026-80048- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-80048
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
- Record
UBUNTU-CVE-2026-80048- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sssdDebian:12 |
All versions, plus listed versions 2.10.1-12.10.1-22.11.1-12.11.1-22.11.1-2.1 Show 22 moreShow less2.12.0-12.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-42.8.2-42.8.2-4+deb12u12.9.1-12.9.1-22.9.2-12.9.4-12.9.4-1.12.9.4-1.1~exp12.9.4-22.9.5-12.9.5-22.9.5-32.9.5-42.9.5-5 |
None known |
sssdDebian:13 |
All versions, plus listed versions 2.10.1-22.11.1-12.11.1-22.11.1-2.12.12.0-1 Show 7 moreShow less2.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-4 |
None known |
sssdDebian:14 |
All versions, plus listed versions 2.10.1-22.11.1-12.11.1-22.11.1-2.12.12.0-1 Show 7 moreShow less2.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-4 |
None known |
sssdUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.5-21.13.1-21.13.2-11.13.3-11.13.4-1 Show 15 moreShow less1.13.4-1ubuntu11.13.4-1ubuntu1.11.13.4-1ubuntu1.21.13.4-1ubuntu1.51.13.4-1ubuntu1.61.13.4-1ubuntu1.71.13.4-1ubuntu1.81.13.4-1ubuntu1.91.13.4-1ubuntu1.101.13.4-1ubuntu1.111.13.4-1ubuntu1.121.13.4-1ubuntu1.131.13.4-1ubuntu1.141.13.4-1ubuntu1.151.13.4-1ubuntu1.15+esm1 |
None known |
sssdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.15.3-2ubuntu11.15.3-3ubuntu11.16.0-5ubuntu11.16.0-5ubuntu21.16.1-1ubuntu1 Show 9 moreShow less1.16.1-1ubuntu1.11.16.1-1ubuntu1.21.16.1-1ubuntu1.31.16.1-1ubuntu1.41.16.1-1ubuntu1.51.16.1-1ubuntu1.61.16.1-1ubuntu1.71.16.1-1ubuntu1.81.16.1-1ubuntu1.8+esm1 |
None known |
sssdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.2.0-4ubuntu12.2.2-12.2.2-1ubuntu12.2.3-1.1ubuntu12.2.3-2 Show 14 moreShow less2.2.3-32.2.3-3ubuntu0.12.2.3-3ubuntu0.22.2.3-3ubuntu0.32.2.3-3ubuntu0.42.2.3-3ubuntu0.62.2.3-3ubuntu0.72.2.3-3ubuntu0.82.2.3-3ubuntu0.92.2.3-3ubuntu0.102.2.3-3ubuntu0.112.2.3-3ubuntu0.122.2.3-3ubuntu0.132.2.3-3ubuntu0.13+esm1 |
None known |
sssdUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.1-2ubuntu42.5.2-4ubuntu12.5.2-4ubuntu32.5.2-4ubuntu42.6.1-1ubuntu3 Show 9 moreShow less2.6.3-1ubuntu32.6.3-1ubuntu3.12.6.3-1ubuntu3.22.6.3-1ubuntu3.32.6.3-1ubuntu3.42.6.3-1ubuntu3.52.6.3-1ubuntu3.62.6.3-1ubuntu3.82.6.3-1ubuntu3.9 |
None known |
sssdUbuntu:24.04:LTS |
All versions, plus listed versions 2.9.1-2ubuntu22.9.1-2ubuntu32.9.2-1ubuntu22.9.4-1ubuntu12.9.4-1.1ubuntu3 Show 10 moreShow less2.9.4-1.1ubuntu52.9.4-1.1ubuntu62.9.4-1.1ubuntu6.12.9.4-1.1ubuntu6.22.9.4-1.1ubuntu6.32.9.4-1.1ubuntu6.42.9.4-1.1ubuntu6.52.9.4-1.1ubuntu6.62.9.4-1.1ubuntu6.72.9.4-1.1ubuntu6.8 |
None known |
sssdUbuntu:26.10 |
All versions, plus listed versions 2.12.0-1ubuntu52.12.0-4ubuntu12.12.0-4ubuntu22.12.0-4ubuntu32.12.0-4ubuntu4 |
None known |
sssdUbuntu:26.04:LTS |
All versions, plus listed versions 2.10.1-2ubuntu52.10.1-2ubuntu72.12.0-1ubuntu32.12.0-1ubuntu42.12.0-1ubuntu5 Show 5 moreShow less2.12.0-1ubuntu5.12.12.0-1ubuntu5.22.12.0-1ubuntu5.32.12.0-1ubuntu5.42.12.0-1ubuntu5.5 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | EUVD, NVD, OSV | |
| facts, products | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-80048 is a medium vulnerability (CVSS 5.5) in Red Hat Enterprise Linux 10, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. No source names a fixed version.