CVE-2026-80048
Red Hat Enterprise Linux 10: Sssd: sssd-kcm: local denial of service via excessive memory preallocation
Red Hat Red Hat Enterprise Linux 10Operating systems
CVSS
5.5MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 7 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the sssd-kcm responder, resulting in a Denial of Service (DoS) for affected deployments.
Text from CVE List