RLSA-2026:97438: Moderate: sssd security, bug fix, and enhancement update

Q: What level of access does an attacker need to exploit the security issue?

The vulnerability has a local attack vector and requires low privileges. No user interaction is required.

Q: What is the expected impact if exploitation succeeds?

The advisory rates the issue as having high availability impact, with no confidentiality or integrity impact indicated. This is consistent with a denial-of-service risk from the out-of-bounds read.

Published Nov 13, 2026

Updated

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

sssd: out-of-bounds read in the sssd (CVE-2026-6245)

Bug Fix(es) and Enhancement(s):

Performance impact with enumerate in SSSD > 2.7.3 [rhel-9] (JIRA:Rocky Linux-143416)

Poor performance of BEREQINITGROUPS handling by 'sssdbe' (LDAP RFC2307, no nested groups) [rhel-9] (JIRA:Rocky Linux-150439)

[RFE] SSSD PAM: Support Microsoft AD PKINIT authentication indicator (ms-pkca) for pamgssapiindicatorsmap [rhel-9] (JIRA:Rocky Linux-152067)

[Rocky Linux9.9] - GDM Support for IdM IdP feature and MFA [SSSD] (JIRA:Rocky Linux-156519)

SSSD Rebase for Rocky Linux 9.9 (JIRA:Rocky Linux-173741)

[Rocky Linux9.9] Man page update: man sssdkrb5localauthplugin ? Missing disable = an2ln (JIRA:Rocky Linux-173742)

[Rocky Linux9.9] Concurrent child processes trigger unnecessarily backtrace (JIRA:Rocky Linux-173743)

[Rocky Linux9.9] Detect foreign security principals in AD group members and silently ignore them (JIRA:Rocky Linux-173744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Affected Software

61 affected componentsFixes available

rocky-linux/libipa_hbac<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libipa_hbac-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_autofs<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_autofs-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_certmap<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_certmap-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_certmap-devel<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_idmap<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_idmap-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_idmap-devel<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_nss_idmap<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_nss_idmap-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_nss_idmap-devel<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_simpleifp<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_simpleifp-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_sudo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/libsss_sudo-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-libipa_hbac<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-libipa_hbac-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-libsss_nss_idmap<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-libsss_nss_idmap-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-sss<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-sss-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-sss-murmur<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-sss-murmur-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-ad<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-ad-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-client<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-client-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-common<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-common-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-common-pac<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-common-pac-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-dbus<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-dbus-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-debugsource<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-idp<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-idp-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-ipa<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-ipa-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-kcm<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-kcm-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-krb5<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-krb5-common<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-krb5-common-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-krb5-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-ldap<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-ldap-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-nfs-idmap<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-nfs-idmap-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-passkey<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-polkit-rules<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-proxy<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-proxy-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-tools<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-tools-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-winbind-idmap<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/sssd-winbind-idmap-debuginfo<0:2.9.9-3.el9

0:2.9.9-3.el9

rocky-linux/python3-sssdconfig<0:2.9.9-3.el9

0:2.9.9-3.el9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/libipa_hbac to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libipa_hbac-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_autofs to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_autofs-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_certmap to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_certmap-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_certmap-devel to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_idmap to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_idmap-devel to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_nss_idmap to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_nss_idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_nss_idmap-devel to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_simpleifp to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_simpleifp-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_sudo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/libsss_sudo-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-libipa_hbac to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-libipa_hbac-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-libsss_nss_idmap to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-libsss_nss_idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-sss to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-sss-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-sss-murmur to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-sss-murmur-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-ad to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-ad-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-client to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-client-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-common to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-common-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-common-pac to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-common-pac-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-dbus to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-dbus-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-debugsource to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-idp to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-idp-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-ipa to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-ipa-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-kcm to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-kcm-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-krb5 to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-krb5-common to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-krb5-common-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-krb5-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-ldap to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-ldap-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-nfs-idmap to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-nfs-idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-passkey to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-passkey-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-polkit-rules to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-proxy to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-proxy-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-tools to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-winbind-idmap to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/sssd-winbind-idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9
Upgrade
Upgrade rocky-linux/python3-sssdconfig to a version that resolves this vulnerability.
Fixed in 0:2.9.9-3.el9

Event History

Nov 13, 2026

Advisory Published

via OSV·06:05 AM

Data Sourced

via OSV·06:05 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-6245

Frequently Asked Questions

What level of access does an attacker need to exploit the security issue?

The vulnerability has a local attack vector and requires low privileges. No user interaction is required.

What is the expected impact if exploitation succeeds?

The advisory rates the issue as having high availability impact, with no confidentiality or integrity impact indicated. This is consistent with a denial-of-service risk from the out-of-bounds read.

RLSA-2026:97438: Moderate: sssd security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need to exploit the security issue?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact