CVE-2026-12610: Sssd: use-after-free crash in sssd' 'sssd_pam' process
A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
Other sources
When authenticating with a YubiKey, the SSSD PAM responder crashes inside ssscertmapmatchcert because the ssscertmapctx pointer passed to it has already been freed and reused for string data from the p11child response. The pointer value 0x6e65687475412056 decodes to ASCII "V Auth en" which is part from the certificate label "X.509 Certificate for PIV Authentication" returned by p11child. This confirms that the freed ssscertmapctx memory was reused during response parsing.
Root cause: ssscertmapctx is owned by the PAM request state. If the request is cancelled or completes while the asynchronous p11child process is still running, the request state (and the context) is freed. When the child eventually returns and p11childdone / parsep11childresponse run, they call ssscertmapmatchcert with a dangling pointer. The certificate data (token name, label, or certificate contents) then occupies the freed memory.
Impact: Denial of service: The PAM responder crashes, breaking authentication in some cases. Potential privilege escalation: Because an attacker controls the smartcard/YubiKey contents, they can influence the data that replaces the freed ssscertmapctx structure, turning this into a controlled use-after-free in a privileged, long-running process (although this looks hard to exploit).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12610?
The severity of CVE-2026-12610 is rated as medium with a score of 6.4.
How do I fix CVE-2026-12610?
To address CVE-2026-12610, it is recommended to update the SSSD package to the latest version provided by Red Hat or other relevant vendors.
What systems are affected by CVE-2026-12610?
CVE-2026-12610 affects Red Hat Enterprise Linux systems that use the SSSD service for authentication with YubiKeys.
What kind of attack can exploit CVE-2026-12610?
An attacker could exploit CVE-2026-12610 to cause a denial of service by manipulating the contents of smartcards or YubiKeys.
What is the nature of the vulnerability in CVE-2026-12610?
CVE-2026-12610 is a use-after-free vulnerability that can cause a crash in the SSSD PAM responder during YubiKey authentication.