CVE-2026-12610 Sssd: use-after-free crash in sssd' 'sssd_pam' process
A local attacker can crash the SSSD PAM responder or potentially escalate privileges by manipulating smartcard or YubiKey data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12610?
CVE-2026-12610 is a medium-severity use after free vulnerability in Redhat Enterprise Linux, published on 30 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
Weakness: CWE-825
Which versions are affected by CVE-2026-12610?
It affects 2 products.
Linux distribution packages (12)
sssd SUSE:Linux Enterprise Micro 5.3 | All versions | 2.5.2-150400.4.48.1 |
sssd SUSE:Linux Enterprise Micro 5.4 | All versions | 2.5.2-150400.4.48.1 |
sssd SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.10.2-150700.9.37.1 |
sssd SUSE:Linux Enterprise Server 16.0 | All versions | 2.10.2-160000.4.1 |
sssd SUSE:Linux Enterprise Server 16.0 | All versions | 2.10.2-160000.4.1 |
sssd SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.16.1-7.76.1 |
sssd SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.10.2-160000.4.1 |
sssd SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.10.2-160000.4.1 |
sssd SUSE:Linux Micro 6.0 | All versions | 2.8.2-9.1 |
sssd SUSE:Linux Micro 6.1 | All versions | 2.9.5-slfo.1.1_6.1 |
sssd SUSE:Linux Micro 6.2 | All versions | 2.10.2-160000.4.1 |
sssd openSUSE:Leap 16.0 | All versions | 2.10.2-160000.4.1 |
Products include Fedoraproject Sssd, Redhat Enterprise Linux.
How do I fix CVE-2026-12610?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-12610 being exploited?
There is no known exploitation of CVE-2026-12610 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2022-4254 Other in SSSD
- CVE-2012-3462 Auth bypass in sssd
- CVE-2026-104048 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation
- CVE-2015-5292 Denial of service in n/a
- CVE-2026-104046 Sssd: sssd: denial of service via incomplete identity provider authentication requests
Sources
Also known as CLSA-2026-1787127601, CLSA-2026-1787894517, DEBIAN-CVE-2026-12610, GHSA-f953-7679-xc38, OESA-2026-3018, OESA-2026-3022 and 11 more.