Important: sssd security, bug fix, and enhancement update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

RHEL 8 : sssd (RHSA-2026:46990)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46990 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication...

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

Important: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

RHEL 10 : sssd (RHSA-2026:46482)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46482 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication...

UBUNTU-CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

Linux Distros Unpatched Vulnerability : CVE-2026-64208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre- decrypt/pre-verify length checks Change the krb5 crypto...

SUSE CVE-2026-64439

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

CVE-2026-64439

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

CVE-2026-64439

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

CVE-2026-64439

CVE-2026-64439: In the Linux kernel, the krb5 AEAD path could free a buffer while an async AEAD worker still held a pointer, causing a use-after-free (KASAN). The fix filters out async AEAD implementations at allocation time in krb5_aead_encrypt()/krb5_aead_decrypt() and corresponding rfc3961_sim...

CVE-2026-64439 crypto: krb5 - filter out async aead implementations at alloc

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

Fedora 43 : sssd (2026-9ab663dcd4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9ab663dcd4 advisory. CVE fixes: CVE-2026-12610 CVE-2026-14474 CVE-2026-14476 - rhbz2494777: CVE-2026-12610 sssd: Use-after-free crash in SSSD' 'sssdpam' process -...

Linux Distros Unpatched Vulnerability : CVE-2026-59851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is...

PT-2026-64660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel's crypto krb5 implementation. The functions krb5 aead encrypt, krb5 aead decrypt, rfc8009 encrypt, and rfc8009 decrypt set a NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-64439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecry...

CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

CVE-2026-64208 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

CVE-2026-64208

Summary : CVE-2026-64208 affects the Linux kernel’s crypto/krb5 and AF_RXRPC path. The root cause was missing pre-decrypt/pre-verify length checks, now fixed by updating the krb5 crypto library to provide facilities for prechecking message length and by applying this in AF_RXRPC to validate DATA ...