RLSA-2026:97077: Moderate: sssd security, bug fix, and enhancement update

Published Nov 13, 2026
·
Updated

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

sssd: out-of-bounds read in the sssd (CVE-2026-6245)

sssd: Use-after-free crash in SSSD' 'sssdpam' process (CVE-2026-12610)

Bug Fix(es) and Enhancement(s):

Concurrent child processes trigger unnecessarily backtrace (JIRA:Rocky Linux-108116)

Performance impact with enumerate in SSSD > 2.7.3 (JIRA:Rocky Linux-109754)

Man page update: man sssdkrb5localauthplugin ? Missing disable = an2ln (JIRA:Rocky Linux-123943)

[RFE] SSSD PAM: Support Microsoft AD PKINIT authentication indicator (ms-pkca) for pamgssapiindicatorsmap (JIRA:Rocky Linux-138905)

Poor performance of BEREQINITGROUPS handling by 'sssdbe' (LDAP RFC2307, no nested groups) (JIRA:Rocky Linux-142964)

SSSD needs to add Plasma Login Manager to the PAM services whitelist for the AD provider (JIRA:Rocky Linux-154156)

Detect foreign security principals in AD group members and silently ignore them (JIRA:Rocky Linux-5049)

[RfE] sssdoidc: IdP client using TLS Certificate for authentication (JIRA:Rocky Linux-83540)

SSSD kerberos plugins export symbols which clash (JIRA:Rocky Linux-151491)

sssdbe segfaults with option "enumerate = true" with idprovider=ldap (JIRA:Rocky Linux-153036)

SSSD: LDAP backend ('sssdbe') initialization fails if DNS in unresponsive (JIRA:Rocky Linux-172303)

SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors (JIRA:Rocky Linux-173660)

[Regression] Cannot log in to FreeIPA account with password immediately after boot (JIRA:Rocky Linux-173663)

'sssctl analyze --help' shows incorrect command in usage field (JIRA:Rocky Linux-178180)

Rebase SSSD for Rocky Linux 10.3 (JIRA:Rocky Linux-183331)

Smart card reader with pinpad fails CLogin. (CKFPROTECTEDAUTHENTICATIONPATH not handled correctly) (JIRA:Rocky Linux-5054)

'sssctl config-check' does not work correctly for "Accessing AD with a MSA" (JIRA:Rocky Linux-111571)

Regression in IPA + Idp authentication with keycloak (JIRA:Rocky Linux-185008)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Affected Software

56 affected componentsFixes available
rocky-linux/sssd-tools-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-nfs-idmap<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-ipa<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_idmap-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-passkey<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-dbus<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-idp-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-sss<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-krb5-common<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_certmap<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-kcm<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-kcm-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-libipa_hbac-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-sss-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_certmap-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-nfs-idmap-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-ad<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_sudo-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-krb5<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-krb5-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-tools<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-winbind-idmap<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-client<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_nss_idmap<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_nss_idmap-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-debugsource<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-libipa_hbac<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-winbind-idmap-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-common-pac-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-sss-murmur-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-dbus-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-ipa-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libipa_hbac-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_autofs<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-ldap-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-common-pac<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-proxy-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_sudo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-proxy<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-common-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libipa_hbac<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-sss-murmur<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-krb5-common-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_nss_idmap-devel<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-ldap<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-idp<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-ad-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-client-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-libsss_nss_idmap<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/sssd-common<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_autofs-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-libsss_nss_idmap-debuginfo<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/libsss_idmap<0:2.13.1-2.el10
0:2.13.1-2.el10
rocky-linux/python3-sssdconfig<0:2.13.1-2.el10
0:2.13.1-2.el10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rocky-linux/sssd-tools-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  2. Upgrade

    Upgrade rocky-linux/sssd-nfs-idmap to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  3. Upgrade

    Upgrade rocky-linux/sssd-ipa to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  4. Upgrade

    Upgrade rocky-linux/libsss_idmap-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  5. Upgrade

    Upgrade rocky-linux/sssd-passkey to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  6. Upgrade

    Upgrade rocky-linux/sssd-dbus to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  7. Upgrade

    Upgrade rocky-linux/sssd-idp-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  8. Upgrade

    Upgrade rocky-linux/python3-sss to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  9. Upgrade

    Upgrade rocky-linux/sssd-krb5-common to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  10. Upgrade

    Upgrade rocky-linux/libsss_certmap to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  11. Upgrade

    Upgrade rocky-linux/sssd-kcm to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  12. Upgrade

    Upgrade rocky-linux/sssd-kcm-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  13. Upgrade

    Upgrade rocky-linux/python3-libipa_hbac-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  14. Upgrade

    Upgrade rocky-linux/python3-sss-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  15. Upgrade

    Upgrade rocky-linux/libsss_certmap-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  16. Upgrade

    Upgrade rocky-linux/sssd-nfs-idmap-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  17. Upgrade

    Upgrade rocky-linux/sssd-ad to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  18. Upgrade

    Upgrade rocky-linux/libsss_sudo-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  19. Upgrade

    Upgrade rocky-linux/sssd-krb5 to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  20. Upgrade

    Upgrade rocky-linux/sssd-krb5-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  21. Upgrade

    Upgrade rocky-linux/sssd-tools to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  22. Upgrade

    Upgrade rocky-linux/sssd-winbind-idmap to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  23. Upgrade

    Upgrade rocky-linux/sssd-client to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  24. Upgrade

    Upgrade rocky-linux/libsss_nss_idmap to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  25. Upgrade

    Upgrade rocky-linux/libsss_nss_idmap-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  26. Upgrade

    Upgrade rocky-linux/sssd-debugsource to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  27. Upgrade

    Upgrade rocky-linux/python3-libipa_hbac to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  28. Upgrade

    Upgrade rocky-linux/sssd-winbind-idmap-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  29. Upgrade

    Upgrade rocky-linux/sssd-common-pac-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  30. Upgrade

    Upgrade rocky-linux/python3-sss-murmur-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  31. Upgrade

    Upgrade rocky-linux/sssd-dbus-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  32. Upgrade

    Upgrade rocky-linux/sssd-ipa-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  33. Upgrade

    Upgrade rocky-linux/libipa_hbac-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  34. Upgrade

    Upgrade rocky-linux/libsss_autofs to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  35. Upgrade

    Upgrade rocky-linux/sssd-ldap-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  36. Upgrade

    Upgrade rocky-linux/sssd-common-pac to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  37. Upgrade

    Upgrade rocky-linux/sssd to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  38. Upgrade

    Upgrade rocky-linux/sssd-proxy-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  39. Upgrade

    Upgrade rocky-linux/libsss_sudo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  40. Upgrade

    Upgrade rocky-linux/sssd-proxy to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  41. Upgrade

    Upgrade rocky-linux/sssd-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  42. Upgrade

    Upgrade rocky-linux/sssd-common-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  43. Upgrade

    Upgrade rocky-linux/libipa_hbac to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  44. Upgrade

    Upgrade rocky-linux/python3-sss-murmur to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  45. Upgrade

    Upgrade rocky-linux/sssd-krb5-common-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  46. Upgrade

    Upgrade rocky-linux/libsss_nss_idmap-devel to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  47. Upgrade

    Upgrade rocky-linux/sssd-ldap to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  48. Upgrade

    Upgrade rocky-linux/sssd-idp to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  49. Upgrade

    Upgrade rocky-linux/sssd-ad-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  50. Upgrade

    Upgrade rocky-linux/sssd-client-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  51. Upgrade

    Upgrade rocky-linux/python3-libsss_nss_idmap to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  52. Upgrade

    Upgrade rocky-linux/sssd-passkey-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  53. Upgrade

    Upgrade rocky-linux/sssd-common to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  54. Upgrade

    Upgrade rocky-linux/libsss_autofs-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  55. Upgrade

    Upgrade rocky-linux/python3-libsss_nss_idmap-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  56. Upgrade

    Upgrade rocky-linux/libsss_idmap to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10
  57. Upgrade

    Upgrade rocky-linux/python3-sssdconfig to a version that resolves this vulnerability.

    Fixed in 0:2.13.1-2.el10

Event History

Nov 13, 2026
Advisory Published
via OSV·06:06 AM
Data Sourced
via OSV·06:06 AM
DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

What level of access does an attacker need to exploit the security issues?

The supplied CVSS vector indicates local access, high privileges, and high attack complexity are required. No user interaction is required.

2

What is the potential impact if the issues are successfully exploited?

The CVSS vector rates confidentiality, integrity, and availability impact as high. The advisory identifies an out-of-bounds read and a use-after-free crash involving SSSD components.

3

Which installed packages should be prioritized for review?

The advisory lists Rocky Linux packages including sssd-tools-debuginfo, sssd-nfs-idmap, sssd-ipa, libsss_idmap-debuginfo, sssd-passkey, sssd-dbus, sssd-idp-debuginfo, and python3-sss. Review systems with these SSSD-related packages installed.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203