CVE-2026-90995

Name of the Vulnerable Software and Affected Versions SSSD (System Security Services Daemon) (affected versions not specified)

Description A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. When the pam app services configuration is enabled and the service item is omitted from the request, a NULL pointer dereference occurs. This results in a denial of service, causing the PAM responder to crash and disrupting authentication services. A NULL pointer dereference is a condition where a program attempts to read or write to a memory address that is NULL, typically leading to a crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, disable the pam app services configuration.