Moderate: sssd security, bug fix, and enhancement update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

* sssd: out-of-bounds read in the sssd (CVE-2026-6245)

* sssd: Use-after-free crash in SSSD' 'sssd_pam' process (CVE-2026-12610)

Bug Fix(es) and Enhancement(s):

* Concurrent child processes trigger unnecessarily backtrace (JIRA:Rocky Linux-108116)

* Performance impact with enumerate in SSSD > 2.7.3 (JIRA:Rocky Linux-109754)

* Man page update: man sssd_krb5_localauth_plugin ? Missing disable = an2ln (JIRA:Rocky Linux-123943)

* [RFE] SSSD PAM: Support Microsoft AD PKINIT authentication indicator (ms-pkca) for pam_gssapi_indicators_map (JIRA:Rocky Linux-138905)

* Poor performance of `BE_REQ_INITGROUPS` handling by 'sssd_be' (LDAP RFC2307, no nested groups) (JIRA:Rocky Linux-142964)

* SSSD needs to add Plasma Login Manager to the PAM services whitelist for the AD provider (JIRA:Rocky Linux-154156)

* Detect foreign security principals in AD group members and silently ignore them (JIRA:Rocky Linux-5049)

* [RfE] sssd_oidc: IdP client using TLS Certificate for authentication (JIRA:Rocky Linux-83540)

* SSSD kerberos plugins export symbols which clash (JIRA:Rocky Linux-151491)

* sssd_be segfaults with option "enumerate = true" with `id_provider=ldap` (JIRA:Rocky Linux-153036)

* SSSD: LDAP backend ('sssd_be') initialization fails if DNS in unresponsive (JIRA:Rocky Linux-172303)

* SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors (JIRA:Rocky Linux-173660)

* [Regression] Cannot log in to FreeIPA account with password immediately after boot (JIRA:Rocky Linux-173663)

* 'sssctl analyze --help' shows incorrect command in usage field (JIRA:Rocky Linux-178180)

* Rebase SSSD for Rocky Linux 10.3 (JIRA:Rocky Linux-183331)

* Smart card reader with pinpad fails C_Login. (CKF_PROTECTED_AUTHENTICATION_PATH not handled correctly) (JIRA:Rocky Linux-5054)

* 'sssctl config-check' does not work correctly for "Accessing AD with a MSA" (JIRA:Rocky Linux-111571)

* Regression in IPA + Idp authentication with keycloak (JIRA:Rocky Linux-185008)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.