Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-104037: Red Hat Enterprise Linux SSSD autofs can crash

CVE-2026-104037 · published 1 month ago

Summary

The SSSD component that handles automatic file system mounts on Red Hat Enterprise Linux versions 6 through 10 can be forced to stop working by a local user sending a malformed request. This causes the service to read invalid memory and crash, leading to a denial of service for users who rely on those mounts. Apply the latest security updates from Red Hat to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	red hat	red hat enterprise linux 10	All versions
–	red hat	red hat enterprise linux 6	All versions
–	red hat	red hat enterprise linux 7	All versions
–	red hat	red hat enterprise linux 8	All versions
–	red hat	red hat enterprise linux 9	All versions
–	red hat	red hat openshift container platform 4	All versions
Debian:12	debian	sssd	All versions
Ubuntu:Pro:16.04:LTS	canonical	sssd	All versions

Original advisory text

Sssd: sssd: denial of service via packet length underflow in autofs responder

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).

References

https://ubuntu.com/security/CVE-2026-104037 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-104037 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2479030 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-104037 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-104037 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published6 Oct 2026

Updated26 Oct 2026

First seen6 Oct 2026

Sources

CVE-2026-104037 · NVD

CVE-2026-104037 · MITRE

DEBIAN-CVE-2026-104037 · OSV

UBUNTU-CVE-2026-104037 · OSV

Track software like this

Free during beta