Summary
It was discovered that the SSSD PAM responder may crash if a physically
proximate attacker manipulates a smartcard or Yubikey. Non-malicious
physically proximate users may not be able to log in depending upon the
details of their legitimate smartcard or Yubikey.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | sssd | 2.6.3-1ubuntu3.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | sssd | 2.9.4-1.1ubuntu6.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | sssd | 2.12.0-1ubuntu5.3 |
Vulnerabilities 1
-
Medium 6.4
Sssd: use-after-free crash in sssd' 'sssd_pam' process
A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey …
References
-
report
https://ubuntu.com/security/CVE-2026-12610