A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-104045 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2478663 | Exploit Issue Tracking Mitigation Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2478663 | Exploit Issue Tracking Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Oct 2026, 15:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/CVE-2026-104045 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2478663 - Exploit, Issue Tracking, Mitigation, Vendor Advisory | |
| First Time |
Redhat openshift Container Platform
Fedoraproject Redhat Redhat enterprise Linux Fedoraproject sssd |
|
| CPE | cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* |
07 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2478663 - |
06 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 21:17
Updated : 2026-10-13 15:35
NVD link : CVE-2026-104045
Mitre link : CVE-2026-104045
CVE.ORG link : CVE-2026-104045
JSON object : View
Products Affected
redhat
- openshift_container_platform
- enterprise_linux
fedoraproject
- sssd
CWE
CWE-772
Missing Release of Resource after Effective Lifetime