SSSD: race between autofs enumeration and map invalidation leaks memory until the responder dies

CVSS 4.7CVE-2026-104045Kernel, userspace & hypervisorcurated

Impact

A local user who can talk to the SSSD autofs responder can send concurrent map enumeration and invalidation requests, leaking memory until the autofs service degrades or crashes. On compute and login nodes that mount home directories or shared scratch via autofs and resolve identity through SSSD, losing the autofs responder means new automount lookups stop resolving - jobs that touch a not-yet-mounted path fail even though the node is otherwise healthy. Confidentiality and integrity are unaffected; the record scores this availability-only with high attack complexity, reflecting that it is a race the attacker has to win repeatedly. Red Hat lists RHEL 6 through 10 and OpenShift Container Platform 4 as affected.

Who can reach it

Local user on the node with the ability to issue autofs requests to SSSD; low privileges are enough, no special device or group membership. Not reachable from the network.

What to do

Install the SSSD update from your distribution and restart sssd (the autofs responder restarts with it); automounts re-resolve afterwards. No node reboot or drain is required. The record does not name fixed package versions - check the Red Hat CVE page for the build that applies to your release.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-104045 https://access.redhat.com/security/cve/CVE-2026-104045 https://bugzilla.redhat.com/show_bug.cgi?id=2478663

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.