CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.

Score

CVSS 3.1 5.5 Medium

Status

Analyzed - secalert@redhat.com

Published

2026-10-05

Last modified

2026-10-28

Weaknesses

CWE-125

Affected products

• Sssd (Fedoraproject)
• Enterprise Linux (Redhat)
• Openshift (Redhat)
• Openshift Container Platform (Redhat)

References

• https://access.redhat.com/security/cve/CVE-2026-104030
• https://bugzilla.redhat.com/show_bug.cgi?id=2479429